# Flog Txt Version 1 # Analyzer Version: 4.4.1 # Analyzer Build Date: Jan 14 2022 06:06:11 # Log Creation Date: 25.04.2022 12:27:06.459 Process: id = "1" image_name = "baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe" page_root = "0x6a8ad000" os_pid = "0x464" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x4a0" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 124 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 125 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 126 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 127 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 128 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 129 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 130 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 131 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 132 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 133 start_va = 0x400000 end_va = 0x43ffff monitored = 1 entry_point = 0x4330bb region_type = mapped_file name = "baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe") Region: id = 134 start_va = 0x77720000 end_va = 0x7789afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 135 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 136 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 137 start_va = 0x7fff0000 end_va = 0x7ff87ff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 138 start_va = 0x7ff87ffa0000 end_va = 0x7ff880160fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 139 start_va = 0x7ff880161000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff880161000" filename = "" Region: id = 277 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 278 start_va = 0x662d0000 end_va = 0x66349fff monitored = 0 entry_point = 0x662e3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 279 start_va = 0x66350000 end_va = 0x6639ffff monitored = 0 entry_point = 0x66368180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 280 start_va = 0x75600000 end_va = 0x756dffff monitored = 0 entry_point = 0x75613980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 281 start_va = 0x663a0000 end_va = 0x663a7fff monitored = 0 entry_point = 0x663a17c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 282 start_va = 0x570000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 283 start_va = 0x6cec0000 end_va = 0x6cf18fff monitored = 1 entry_point = 0x6ced0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 284 start_va = 0x75600000 end_va = 0x756dffff monitored = 0 entry_point = 0x75613980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 285 start_va = 0x75480000 end_va = 0x755fdfff monitored = 0 entry_point = 0x75531b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 286 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 287 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 288 start_va = 0x440000 end_va = 0x4fdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 289 start_va = 0x500000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 290 start_va = 0x743a0000 end_va = 0x74431fff monitored = 0 entry_point = 0x743e0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 291 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 292 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 293 start_va = 0x74650000 end_va = 0x746cafff monitored = 0 entry_point = 0x7466e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 294 start_va = 0x748c0000 end_va = 0x7497dfff monitored = 0 entry_point = 0x748f5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 295 start_va = 0x500000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 296 start_va = 0x550000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 297 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 298 start_va = 0x760000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 299 start_va = 0x76ae0000 end_va = 0x76b23fff monitored = 0 entry_point = 0x76af9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 300 start_va = 0x75260000 end_va = 0x7530cfff monitored = 0 entry_point = 0x75274f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 301 start_va = 0x74450000 end_va = 0x7446dfff monitored = 0 entry_point = 0x7445b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 302 start_va = 0x74440000 end_va = 0x74449fff monitored = 0 entry_point = 0x74442a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 303 start_va = 0x74590000 end_va = 0x745e7fff monitored = 0 entry_point = 0x745d25c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 304 start_va = 0x860000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 305 start_va = 0x6ce40000 end_va = 0x6ceb8fff monitored = 1 entry_point = 0x6ce4f82a region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 306 start_va = 0x77240000 end_va = 0x77284fff monitored = 0 entry_point = 0x7725de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 307 start_va = 0x77290000 end_va = 0x7744cfff monitored = 0 entry_point = 0x77372a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 308 start_va = 0x76b30000 end_va = 0x76c7efff monitored = 0 entry_point = 0x76be6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 309 start_va = 0x77450000 end_va = 0x77596fff monitored = 0 entry_point = 0x77461cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 310 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 311 start_va = 0x860000 end_va = 0x9e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000860000" filename = "" Region: id = 312 start_va = 0xa20000 end_va = 0xa2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 313 start_va = 0x74ea0000 end_va = 0x74ecafff monitored = 0 entry_point = 0x74ea5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 314 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 315 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 316 start_va = 0x670000 end_va = 0x6a9fff monitored = 1 entry_point = 0x6a30bb region_type = mapped_file name = "baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe") Region: id = 317 start_va = 0xa30000 end_va = 0xbb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 318 start_va = 0xbc0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 319 start_va = 0x76e20000 end_va = 0x76e2bfff monitored = 0 entry_point = 0x76e23930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 320 start_va = 0x6ce30000 end_va = 0x6ce37fff monitored = 0 entry_point = 0x6ce317b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 321 start_va = 0x6c400000 end_va = 0x6cab0fff monitored = 1 entry_point = 0x6c415d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 322 start_va = 0x6cd30000 end_va = 0x6ce24fff monitored = 0 entry_point = 0x6cd84160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 323 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 324 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 325 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 326 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 327 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 328 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 329 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 330 start_va = 0x6b0000 end_va = 0x6b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 331 start_va = 0x6c0000 end_va = 0x6c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 332 start_va = 0x1fc0000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 333 start_va = 0x2110000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 334 start_va = 0x6d0000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 335 start_va = 0x1fc0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fc0000" filename = "" Region: id = 336 start_va = 0x2100000 end_va = 0x210ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 337 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 338 start_va = 0x22e0000 end_va = 0x42dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 339 start_va = 0x2110000 end_va = 0x21affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002110000" filename = "" Region: id = 340 start_va = 0x22d0000 end_va = 0x22dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 341 start_va = 0x710000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 342 start_va = 0x21b0000 end_va = 0x22affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 343 start_va = 0x42e0000 end_va = 0x4616fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 344 start_va = 0x6b1d0000 end_va = 0x6c3f7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll") Region: id = 345 start_va = 0x74720000 end_va = 0x7480afff monitored = 0 entry_point = 0x7475d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 346 start_va = 0x4620000 end_va = 0x46b0fff monitored = 0 entry_point = 0x4658cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 347 start_va = 0x706b0000 end_va = 0x70724fff monitored = 0 entry_point = 0x706e9a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 348 start_va = 0x4620000 end_va = 0x480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004620000" filename = "" Region: id = 349 start_va = 0x6d720000 end_va = 0x6d732fff monitored = 0 entry_point = 0x6d729950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 350 start_va = 0x6ffd0000 end_va = 0x6fffefff monitored = 0 entry_point = 0x6ffe95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 351 start_va = 0x740f0000 end_va = 0x7410afff monitored = 0 entry_point = 0x740f9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 352 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000750000" filename = "" Region: id = 353 start_va = 0x6b150000 end_va = 0x6b1cdfff monitored = 1 entry_point = 0x6b151140 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 354 start_va = 0x753c0000 end_va = 0x75451fff monitored = 0 entry_point = 0x753f8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 355 start_va = 0x9f0000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009f0000" filename = "" Region: id = 356 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 357 start_va = 0xa10000 end_va = 0xa1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a10000" filename = "" Region: id = 358 start_va = 0x4620000 end_va = 0x47affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004620000" filename = "" Region: id = 359 start_va = 0x4800000 end_va = 0x480ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 360 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 361 start_va = 0x5e430000 end_va = 0x5e4cbfff monitored = 1 entry_point = 0x5e4be9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 362 start_va = 0x4620000 end_va = 0x46bbfff monitored = 1 entry_point = 0x46ae9b2 region_type = mapped_file name = "microsoft.visualbasic.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll") Region: id = 363 start_va = 0x47a0000 end_va = 0x47affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047a0000" filename = "" Region: id = 364 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 365 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 366 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 367 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 368 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 369 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 370 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 371 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 372 start_va = 0xa00000 end_va = 0xa0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 373 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 374 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 375 start_va = 0x6a7a0000 end_va = 0x6b14bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll") Region: id = 376 start_va = 0x6a080000 end_va = 0x6a791fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll") Region: id = 377 start_va = 0x20d0000 end_va = 0x20dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020d0000" filename = "" Region: id = 378 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 379 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 380 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 381 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 382 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 383 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 384 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 385 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 386 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 387 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 388 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 389 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 390 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 391 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 392 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 393 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 394 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 395 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 396 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 397 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 398 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 399 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 400 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 401 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 402 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 403 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 404 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 405 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 406 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 407 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 408 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 409 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 410 start_va = 0x20f0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 411 start_va = 0x22b0000 end_va = 0x22bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022b0000" filename = "" Region: id = 412 start_va = 0x22c0000 end_va = 0x22cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022c0000" filename = "" Region: id = 413 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 414 start_va = 0x4810000 end_va = 0x490ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004810000" filename = "" Region: id = 415 start_va = 0x46c0000 end_va = 0x4721fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 416 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 417 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 418 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 419 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 420 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 421 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 422 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 423 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 424 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 425 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 426 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 427 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 428 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 429 start_va = 0x4730000 end_va = 0x4767fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004730000" filename = "" Region: id = 430 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 431 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 432 start_va = 0x20e0000 end_va = 0x20effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 433 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 434 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 435 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 436 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 437 start_va = 0x22b0000 end_va = 0x22c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022b0000" filename = "" Region: id = 438 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 439 start_va = 0x20c0000 end_va = 0x20cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 440 start_va = 0x20c0000 end_va = 0x20c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020c0000" filename = "" Region: id = 441 start_va = 0x20f0000 end_va = 0x20f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020f0000" filename = "" Region: id = 442 start_va = 0x4910000 end_va = 0x49effff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 443 start_va = 0x6cd00000 end_va = 0x6cd27fff monitored = 0 entry_point = 0x6cd07820 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 444 start_va = 0x6a000000 end_va = 0x6a070fff monitored = 0 entry_point = 0x6a0569e0 region_type = mapped_file name = "efswrt.dll" filename = "\\Windows\\SysWOW64\\efswrt.dll" (normalized: "c:\\windows\\syswow64\\efswrt.dll") Region: id = 445 start_va = 0x751c0000 end_va = 0x7524cfff monitored = 0 entry_point = 0x75209b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 446 start_va = 0x74020000 end_va = 0x740e7fff monitored = 0 entry_point = 0x7408ae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 447 start_va = 0x69fb0000 end_va = 0x69ff8fff monitored = 0 entry_point = 0x69fb6450 region_type = mapped_file name = "edputil.dll" filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll") Region: id = 448 start_va = 0x4770000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 449 start_va = 0x4780000 end_va = 0x478ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004780000" filename = "" Region: id = 450 start_va = 0x47b0000 end_va = 0x47cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 451 start_va = 0x4790000 end_va = 0x479ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004790000" filename = "" Region: id = 452 start_va = 0x47d0000 end_va = 0x47dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047d0000" filename = "" Region: id = 453 start_va = 0x47e0000 end_va = 0x47effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047e0000" filename = "" Region: id = 454 start_va = 0x47f0000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047f0000" filename = "" Region: id = 455 start_va = 0x49f0000 end_va = 0x49fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 456 start_va = 0x4a00000 end_va = 0x4a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 457 start_va = 0x4a10000 end_va = 0x4a1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 458 start_va = 0x4a20000 end_va = 0x4a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 459 start_va = 0x4a30000 end_va = 0x4a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a30000" filename = "" Region: id = 460 start_va = 0x4a40000 end_va = 0x4a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a40000" filename = "" Region: id = 461 start_va = 0x4a50000 end_va = 0x4a5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a50000" filename = "" Region: id = 462 start_va = 0x4a60000 end_va = 0x4a6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 463 start_va = 0x4a70000 end_va = 0x4a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a70000" filename = "" Region: id = 464 start_va = 0x4a80000 end_va = 0x4a8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a80000" filename = "" Region: id = 465 start_va = 0x4a90000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a90000" filename = "" Region: id = 466 start_va = 0x4aa0000 end_va = 0x4aaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004aa0000" filename = "" Region: id = 467 start_va = 0x4ab0000 end_va = 0x4abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ab0000" filename = "" Region: id = 468 start_va = 0x4ac0000 end_va = 0x4acffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ac0000" filename = "" Region: id = 469 start_va = 0x4ad0000 end_va = 0x4adffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ad0000" filename = "" Region: id = 470 start_va = 0x4ae0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ae0000" filename = "" Region: id = 471 start_va = 0x4af0000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 472 start_va = 0x4b00000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b00000" filename = "" Region: id = 473 start_va = 0x4b10000 end_va = 0x4b1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b10000" filename = "" Region: id = 474 start_va = 0x4b20000 end_va = 0x4b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b20000" filename = "" Region: id = 475 start_va = 0x4b30000 end_va = 0x4b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b30000" filename = "" Region: id = 476 start_va = 0x4b40000 end_va = 0x4b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b40000" filename = "" Region: id = 477 start_va = 0x4b50000 end_va = 0x4b5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b50000" filename = "" Region: id = 478 start_va = 0x4b60000 end_va = 0x4b6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b60000" filename = "" Region: id = 479 start_va = 0x4b70000 end_va = 0x4b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b70000" filename = "" Region: id = 480 start_va = 0x4b80000 end_va = 0x4b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b80000" filename = "" Region: id = 481 start_va = 0x4b90000 end_va = 0x4b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b90000" filename = "" Region: id = 482 start_va = 0x4ba0000 end_va = 0x4baffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ba0000" filename = "" Region: id = 483 start_va = 0x4bb0000 end_va = 0x4bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bb0000" filename = "" Region: id = 484 start_va = 0x4bc0000 end_va = 0x4bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bc0000" filename = "" Region: id = 485 start_va = 0x4bd0000 end_va = 0x4bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bd0000" filename = "" Region: id = 486 start_va = 0x4be0000 end_va = 0x4beffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004be0000" filename = "" Region: id = 487 start_va = 0x4bf0000 end_va = 0x4bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bf0000" filename = "" Region: id = 488 start_va = 0x4c00000 end_va = 0x4c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 489 start_va = 0x4c10000 end_va = 0x4c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c10000" filename = "" Region: id = 490 start_va = 0x4c20000 end_va = 0x4c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c20000" filename = "" Region: id = 491 start_va = 0x4c30000 end_va = 0x4c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 492 start_va = 0x4c40000 end_va = 0x4c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c40000" filename = "" Region: id = 493 start_va = 0x4c50000 end_va = 0x4c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c50000" filename = "" Region: id = 494 start_va = 0x4c60000 end_va = 0x4c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c60000" filename = "" Region: id = 495 start_va = 0x4c70000 end_va = 0x4c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c70000" filename = "" Region: id = 496 start_va = 0x4c80000 end_va = 0x4c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 497 start_va = 0x4c90000 end_va = 0x4c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c90000" filename = "" Region: id = 498 start_va = 0x4ca0000 end_va = 0x4caffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ca0000" filename = "" Region: id = 499 start_va = 0x4cb0000 end_va = 0x4cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cb0000" filename = "" Region: id = 500 start_va = 0x4cc0000 end_va = 0x4ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 501 start_va = 0x4cd0000 end_va = 0x4cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 502 start_va = 0x4ce0000 end_va = 0x4ceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ce0000" filename = "" Region: id = 503 start_va = 0x4cf0000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 504 start_va = 0x4d00000 end_va = 0x4d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 505 start_va = 0x4d10000 end_va = 0x4d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d10000" filename = "" Region: id = 506 start_va = 0x4d20000 end_va = 0x4d2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d20000" filename = "" Region: id = 507 start_va = 0x4d30000 end_va = 0x4d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d30000" filename = "" Region: id = 508 start_va = 0x4d40000 end_va = 0x4d4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d40000" filename = "" Region: id = 509 start_va = 0x4d50000 end_va = 0x4d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d50000" filename = "" Region: id = 510 start_va = 0x4d70000 end_va = 0x4d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d70000" filename = "" Region: id = 511 start_va = 0x4d80000 end_va = 0x4d8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d80000" filename = "" Region: id = 512 start_va = 0x4d90000 end_va = 0x4d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d90000" filename = "" Region: id = 513 start_va = 0x4da0000 end_va = 0x4daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004da0000" filename = "" Region: id = 514 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 515 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 516 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 517 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 518 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 519 start_va = 0x4e00000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 520 start_va = 0x4e30000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 521 start_va = 0x4e40000 end_va = 0x4e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e40000" filename = "" Region: id = 522 start_va = 0x4e50000 end_va = 0x4e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 523 start_va = 0x4e60000 end_va = 0x4e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e60000" filename = "" Region: id = 524 start_va = 0x4e70000 end_va = 0x4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 525 start_va = 0x4e80000 end_va = 0x4e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 526 start_va = 0x4e90000 end_va = 0x4e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 527 start_va = 0x4ea0000 end_va = 0x4eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 528 start_va = 0x4eb0000 end_va = 0x4ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004eb0000" filename = "" Region: id = 529 start_va = 0x4ec0000 end_va = 0x4ecffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 530 start_va = 0x4ed0000 end_va = 0x4edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 531 start_va = 0x4ee0000 end_va = 0x4eeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ee0000" filename = "" Region: id = 532 start_va = 0x4ef0000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ef0000" filename = "" Region: id = 533 start_va = 0x4f00000 end_va = 0x4f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 534 start_va = 0x4f10000 end_va = 0x4f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f10000" filename = "" Region: id = 535 start_va = 0x4f20000 end_va = 0x4f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f20000" filename = "" Region: id = 536 start_va = 0x4f30000 end_va = 0x4f3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f30000" filename = "" Region: id = 537 start_va = 0x4f40000 end_va = 0x4f4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f40000" filename = "" Region: id = 538 start_va = 0x4f50000 end_va = 0x4f5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f50000" filename = "" Region: id = 539 start_va = 0x4f60000 end_va = 0x4f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f60000" filename = "" Region: id = 540 start_va = 0x4f70000 end_va = 0x4f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f70000" filename = "" Region: id = 541 start_va = 0x4f80000 end_va = 0x4faffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f80000" filename = "" Region: id = 542 start_va = 0x4fb0000 end_va = 0x4fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fb0000" filename = "" Region: id = 543 start_va = 0x4fc0000 end_va = 0x4fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fc0000" filename = "" Region: id = 544 start_va = 0x4770000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 545 start_va = 0x4770000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 546 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 694 start_va = 0x47b0000 end_va = 0x47effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 695 start_va = 0x49f0000 end_va = 0x4aeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 696 start_va = 0x4af0000 end_va = 0x4b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 697 start_va = 0x4b30000 end_va = 0x4c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004b30000" filename = "" Region: id = 700 start_va = 0x4770000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 701 start_va = 0x4770000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 702 start_va = 0x4770000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 703 start_va = 0x4770000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 704 start_va = 0x4770000 end_va = 0x477ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004770000" filename = "" Region: id = 707 start_va = 0x4c30000 end_va = 0x4c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c30000" filename = "" Region: id = 708 start_va = 0x4c70000 end_va = 0x4d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c70000" filename = "" Thread: id = 1 os_tid = 0xc60 [0112.507] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0113.468] RoInitialize () returned 0x1 [0113.468] RoUninitialize () returned 0x0 [0119.264] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe", nBufferLength=0x105, lpBuffer=0x19edcc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe", lpFilePart=0x0) returned 0x62 [0119.441] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19f308 | out: pfEnabled=0x19f308) returned 0x0 [0119.574] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x19f1d8, nSize=0x80 | out: lpBuffer="") returned 0x15 [0119.579] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x19f1d8, nSize=0x80 | out: lpBuffer="") returned 0x15 [0119.616] EtwEventRegister (in: ProviderId=0x22fd5bc, EnableCallback=0x47a0746, CallbackContext=0x0, RegHandle=0x22fd598 | out: RegHandle=0x22fd598) returned 0x0 [0119.778] EtwEventSetInformation (RegHandle=0x7a9618, InformationClass=0x2b, EventInformation=0x2, InformationLength=0x22fd54c) returned 0x0 [0122.955] GetFullPathNameW (in: lpFileName="FindMe", nBufferLength=0x105, lpBuffer=0x19ee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\FindMe", lpFilePart=0x0) returned 0x24 [0122.956] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\FindMe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\findme")) returned 0 [0122.958] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x19f188, nSize=0xa8 | out: lpBuffer="") returned 0x24 [0124.080] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19ec14 | out: lpLuid=0x19ec14*(LowPart=0x14, HighPart=0)) returned 1 [0124.083] GetCurrentProcess () returned 0xffffffff [0124.084] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19ec10 | out: TokenHandle=0x19ec10*=0x2ac) returned 1 [0124.085] AdjustTokenPrivileges (in: TokenHandle=0x2ac, DisableAllPrivileges=0, NewState=0x230121c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0124.088] CloseHandle (hObject=0x2ac) returned 1 [0124.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32e54d0, Length=0x20000, ResultLength=0x19f2f0 | out: SystemInformation=0x32e54d0, ResultLength=0x19f2f0*=0x178e0) returned 0x0 [0124.293] GetEnvironmentVariableW (in: lpName="WINDIR", lpBuffer=0x19f188, nSize=0xa8 | out: lpBuffer="") returned 0xa [0124.358] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe.config", nBufferLength=0x105, lpBuffer=0x19ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe.config", lpFilePart=0x0) returned 0x69 [0124.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f098) returned 1 [0124.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f114 | out: lpFileInformation=0x19f114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0124.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f094) returned 1 [0125.373] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37e00, lpName=0x0) returned 0x2b0 [0125.377] CloseHandle (hObject=0x2b0) returned 1 [0125.714] GetACP () returned 0x4e4 [0126.303] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", nBufferLength=0x105, lpBuffer=0x19ee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", lpFilePart=0x0) returned 0x33 [0126.304] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe")) returned 0 [0126.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe", nBufferLength=0x105, lpBuffer=0x19edfc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe", lpFilePart=0x0) returned 0x39 [0126.310] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19ede8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0126.311] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", nBufferLength=0x105, lpBuffer=0x19edfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", lpFilePart=0x0) returned 0x33 [0126.311] CopyFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe"), bFailIfExists=0) returned 1 [0129.615] CoTaskMemAlloc (cb=0xd) returned 0x7c6d28 [0129.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x23754a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0129.616] LoadLibraryA (lpLibFileName="kernel32") returned 0x75600000 [0129.616] CoTaskMemFree (pv=0x7c6d28) [0129.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x19cd10, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessAú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 14 [0129.643] GetProcAddress (hModule=0x75600000, lpProcName="CreateProcessA") returned 0x75640750 [0129.662] CoTaskMemAlloc (cb=0xd) returned 0x7c6c08 [0129.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2376ebc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0129.662] LoadLibraryA (lpLibFileName="kernel32") returned 0x75600000 [0129.663] CoTaskMemFree (pv=0x7c6c08) [0129.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x19cd0c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemorynú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 17 [0129.663] GetProcAddress (hModule=0x75600000, lpProcName="ReadProcessMemory") returned 0x75641c80 [0129.674] CoTaskMemAlloc (cb=0xd) returned 0x7c6d28 [0129.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x23788dc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0129.674] LoadLibraryA (lpLibFileName="kernel32") returned 0x75600000 [0129.674] CoTaskMemFree (pv=0x7c6d28) [0129.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x19cd0c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemoryú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 18 [0129.674] GetProcAddress (hModule=0x75600000, lpProcName="WriteProcessMemory") returned 0x75642850 [0129.693] CoTaskMemAlloc (cb=0xd) returned 0x7c6b00 [0129.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x237a2f4, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0129.693] LoadLibraryA (lpLibFileName="kernel32") returned 0x75600000 [0129.694] CoTaskMemFree (pv=0x7c6b00) [0129.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x19cd0c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContextÅnú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 16 [0129.694] GetProcAddress (hModule=0x75600000, lpProcName="GetThreadContext") returned 0x7561ec60 [0129.702] CoTaskMemAlloc (cb=0xa) returned 0x7c6bc0 [0129.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x237bd0c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0129.702] LoadLibraryA (lpLibFileName="ntdll") returned 0x77720000 [0129.702] CoTaskMemFree (pv=0x7c6bc0) [0129.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NtSetContextThread", cchWideChar=18, lpMultiByteStr=0x19cd0c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NtSetContextThreadú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 18 [0129.702] GetProcAddress (hModule=0x77720000, lpProcName="NtSetContextThread") returned 0x777983c0 [0129.706] CoTaskMemAlloc (cb=0xa) returned 0x7c6bd8 [0129.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x237d71c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0129.706] LoadLibraryA (lpLibFileName="ntdll") returned 0x77720000 [0129.707] CoTaskMemFree (pv=0x7c6bd8) [0129.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NtUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x19cd08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NtUnmapViewOfSectionÅnú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 20 [0129.707] GetProcAddress (hModule=0x77720000, lpProcName="NtUnmapViewOfSection") returned 0x77796f40 [0129.709] CoTaskMemAlloc (cb=0xd) returned 0x7c6b00 [0129.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x237f048, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8 [0129.709] LoadLibraryA (lpLibFileName="kernel32") returned 0x75600000 [0129.710] CoTaskMemFree (pv=0x7c6b00) [0129.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x19cd10, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocExú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 14 [0129.710] GetProcAddress (hModule=0x75600000, lpProcName="VirtualAllocEx") returned 0x75642730 [0129.712] CoTaskMemAlloc (cb=0xa) returned 0x7c6b00 [0129.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x2380978, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5 [0129.712] LoadLibraryA (lpLibFileName="ntdll") returned 0x77720000 [0129.713] CoTaskMemFree (pv=0x7c6b00) [0129.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NtResumeThread", cchWideChar=14, lpMultiByteStr=0x19cd10, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NtResumeThreadú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 14 [0129.713] GetProcAddress (hModule=0x77720000, lpProcName="NtResumeThread") returned 0x777971c0 [0129.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", cchWideChar=47, lpMultiByteStr=0x19cc64, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exelipú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 47 [0129.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe\"", cchWideChar=49, lpMultiByteStr=0x19cc30, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe\"Ì\x19", lpUsedDefaultChar=0x0) returned 49 [0129.716] CreateProcessA (in: lpApplicationName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", lpCommandLine="\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19cccc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x23739ec | out: lpCommandLine="\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe\"", lpProcessInformation=0x23739ec*(hProcess=0x2b8, hThread=0x2b4, dwProcessId=0x82c, dwThreadId=0xbf8)) returned 1 [0129.887] CoTaskMemFree (pv=0x0) [0129.888] GetThreadContext (in: hThread=0x2b4, lpContext=0x2380b38 | out: lpContext=0x2380b38*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x35e000, Edx=0x0, Ecx=0x0, Eax=0x439422, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0129.907] ReadProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x35e008, lpBuffer=0x19cdbc, nSize=0x4, lpNumberOfBytesRead=0x19cdac | out: lpBuffer=0x19cdbc*, lpNumberOfBytesRead=0x19cdac*=0x4) returned 1 [0129.918] NtUnmapViewOfSection (ProcessHandle=0x2b8, BaseAddress=0x400000) returned 0x0 [0129.959] VirtualAllocEx (hProcess=0x2b8, lpAddress=0x400000, dwSize=0x3a000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0129.964] WriteProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x400000, lpBuffer=0x33a7750*, nSize=0x200, lpNumberOfBytesWritten=0x19cdac | out: lpBuffer=0x33a7750*, lpNumberOfBytesWritten=0x19cdac*=0x200) returned 1 [0129.996] WriteProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x402000, lpBuffer=0x33dc970*, nSize=0x1c000, lpNumberOfBytesWritten=0x19cdac | out: lpBuffer=0x33dc970*, lpNumberOfBytesWritten=0x19cdac*=0x1c000) returned 1 [0130.041] WriteProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x41e000, lpBuffer=0x33f8990*, nSize=0x18e00, lpNumberOfBytesWritten=0x19cdac | out: lpBuffer=0x33f8990*, lpNumberOfBytesWritten=0x19cdac*=0x18e00) returned 1 [0130.154] WriteProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x438000, lpBuffer=0x2380e10*, nSize=0x200, lpNumberOfBytesWritten=0x19cdac | out: lpBuffer=0x2380e10*, lpNumberOfBytesWritten=0x19cdac*=0x200) returned 1 [0130.339] WriteProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x35e008, lpBuffer=0x238101c*, nSize=0x4, lpNumberOfBytesWritten=0x19cdac | out: lpBuffer=0x238101c*, lpNumberOfBytesWritten=0x19cdac*=0x4) returned 1 [0130.354] NtSetContextThread (ThreadHandle=0x2b4, Context=0x2380b38*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x35e000, Edx=0x0, Ecx=0x0, Eax=0x41dea2, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0130.358] NtResumeThread (in: ThreadHandle=0x2b4, SuspendCount=0x19dbac | out: SuspendCount=0x19dbac*=0x1) returned 0x0 [0146.596] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0146.596] CObjectContext::QueryInterface () returned 0x0 [0146.597] CObjectContext::GetCurrentThreadType () returned 0x0 [0146.597] Release () returned 0x0 [0146.598] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x7783b8*=0x14c, lpdwindex=0x19f094) Thread: id = 2 os_tid = 0x674 Thread: id = 3 os_tid = 0xb0c Thread: id = 4 os_tid = 0x600 [0113.471] CoGetContextToken (in: pToken=0x22afc3c | out: pToken=0x22afc3c) returned 0x800401f0 [0113.471] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0113.471] RoInitialize () returned 0x1 [0113.471] RoUninitialize () returned 0x0 [0146.735] EtwEventUnregister (RegHandle=0x7a9618) returned 0x0 [0146.790] CloseHandle (hObject=0x2b0) returned 1 [0146.791] UnmapViewOfFile (lpBaseAddress=0x22b0000) returned 1 Thread: id = 10 os_tid = 0xd1c Thread: id = 11 os_tid = 0x5dc Thread: id = 12 os_tid = 0x1014 Process: id = "2" image_name = "svhost.exe" filename = "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe" page_root = "0x46bee000" os_pid = "0x82c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x464" cmd_line = "\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 547 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 548 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 549 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 550 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 551 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 552 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 553 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 554 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 555 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 556 start_va = 0x400000 end_va = 0x43ffff monitored = 1 entry_point = 0x439422 region_type = mapped_file name = "svhost.exe" filename = "\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe") Region: id = 557 start_va = 0x77720000 end_va = 0x7789afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 558 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 559 start_va = 0xfffb0000 end_va = 0xfffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fffb0000" filename = "" Region: id = 560 start_va = 0xfffe0000 end_va = 0x7ff87ff9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 561 start_va = 0x7ff87ffa0000 end_va = 0x7ff880160fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 562 start_va = 0x7ff880161000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff880161000" filename = "" Region: id = 563 start_va = 0x400000 end_va = 0x439fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 564 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 565 start_va = 0x662d0000 end_va = 0x66349fff monitored = 0 entry_point = 0x662e3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 566 start_va = 0x66350000 end_va = 0x6639ffff monitored = 0 entry_point = 0x66368180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 567 start_va = 0x75600000 end_va = 0x756dffff monitored = 0 entry_point = 0x75613980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 568 start_va = 0x663a0000 end_va = 0x663a7fff monitored = 0 entry_point = 0x663a17c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 569 start_va = 0x500000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 570 start_va = 0x6cec0000 end_va = 0x6cf18fff monitored = 1 entry_point = 0x6ced0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 571 start_va = 0x75600000 end_va = 0x756dffff monitored = 0 entry_point = 0x75613980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 572 start_va = 0x75480000 end_va = 0x755fdfff monitored = 0 entry_point = 0x75531b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 573 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 574 start_va = 0xffeb0000 end_va = 0xfffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ffeb0000" filename = "" Region: id = 575 start_va = 0x20000 end_va = 0x3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 576 start_va = 0x500000 end_va = 0x5bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 577 start_va = 0x640000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 578 start_va = 0x7fff0000 end_va = 0x7fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 579 start_va = 0x80000000 end_va = 0x8000ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000080000000" filename = "" Region: id = 580 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 581 start_va = 0x30000 end_va = 0x3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 582 start_va = 0x74650000 end_va = 0x746cafff monitored = 0 entry_point = 0x7466e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 583 start_va = 0x748c0000 end_va = 0x7497dfff monitored = 0 entry_point = 0x748f5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 584 start_va = 0x440000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 585 start_va = 0x740000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 586 start_va = 0x76ae0000 end_va = 0x76b23fff monitored = 0 entry_point = 0x76af9d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 587 start_va = 0x75260000 end_va = 0x7530cfff monitored = 0 entry_point = 0x75274f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 588 start_va = 0x74450000 end_va = 0x7446dfff monitored = 0 entry_point = 0x7445b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 589 start_va = 0x74440000 end_va = 0x74449fff monitored = 0 entry_point = 0x74442a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 590 start_va = 0x74590000 end_va = 0x745e7fff monitored = 0 entry_point = 0x745d25c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 591 start_va = 0x840000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 592 start_va = 0x6ce40000 end_va = 0x6ceb8fff monitored = 1 entry_point = 0x6ce4f82a region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 593 start_va = 0x77240000 end_va = 0x77284fff monitored = 0 entry_point = 0x7725de90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 594 start_va = 0x77290000 end_va = 0x7744cfff monitored = 0 entry_point = 0x77372a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 595 start_va = 0x76b30000 end_va = 0x76c7efff monitored = 0 entry_point = 0x76be6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 596 start_va = 0x77450000 end_va = 0x77596fff monitored = 0 entry_point = 0x77461cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 597 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 598 start_va = 0x9a0000 end_va = 0xb27fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 599 start_va = 0x74ea0000 end_va = 0x74ecafff monitored = 0 entry_point = 0x74ea5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 600 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 601 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 602 start_va = 0x480000 end_va = 0x4bffff monitored = 1 entry_point = 0x4b9422 region_type = mapped_file name = "svhost.exe" filename = "\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe") Region: id = 603 start_va = 0xb30000 end_va = 0xcb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b30000" filename = "" Region: id = 604 start_va = 0xcc0000 end_va = 0x20bffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cc0000" filename = "" Region: id = 605 start_va = 0x76e20000 end_va = 0x76e2bfff monitored = 0 entry_point = 0x76e23930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 606 start_va = 0x6ce30000 end_va = 0x6ce37fff monitored = 0 entry_point = 0x6ce317b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 607 start_va = 0x20c0000 end_va = 0x2770fff monitored = 1 entry_point = 0x20d5d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 608 start_va = 0x6c400000 end_va = 0x6cab0fff monitored = 1 entry_point = 0x6c415d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 609 start_va = 0x6cd30000 end_va = 0x6ce24fff monitored = 0 entry_point = 0x6cd84160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 610 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 611 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 612 start_va = 0x490000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 613 start_va = 0x4a0000 end_va = 0x4affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 614 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 615 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 616 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 617 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 618 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 619 start_va = 0x840000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 620 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 621 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 622 start_va = 0x5e0000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 623 start_va = 0x20c0000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 624 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 625 start_va = 0x21c0000 end_va = 0x41bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021c0000" filename = "" Region: id = 626 start_va = 0x840000 end_va = 0x8dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 627 start_va = 0x910000 end_va = 0x91ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 628 start_va = 0x920000 end_va = 0x95ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000920000" filename = "" Region: id = 629 start_va = 0x41c0000 end_va = 0x42bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041c0000" filename = "" Region: id = 630 start_va = 0x42c0000 end_va = 0x45f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 631 start_va = 0x6b1d0000 end_va = 0x6c3f7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll") Region: id = 632 start_va = 0x74720000 end_va = 0x7480afff monitored = 0 entry_point = 0x7475d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 633 start_va = 0x4600000 end_va = 0x4690fff monitored = 0 entry_point = 0x4638cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 634 start_va = 0x706b0000 end_va = 0x70724fff monitored = 0 entry_point = 0x706e9a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 635 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 636 start_va = 0x630000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 637 start_va = 0x6b150000 end_va = 0x6b1cdfff monitored = 1 entry_point = 0x6b151140 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 638 start_va = 0x753c0000 end_va = 0x75451fff monitored = 0 entry_point = 0x753f8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 639 start_va = 0x8e0000 end_va = 0x8effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008e0000" filename = "" Region: id = 640 start_va = 0x6a7a0000 end_va = 0x6b14bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll") Region: id = 641 start_va = 0x69e20000 end_va = 0x69facfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll") Region: id = 642 start_va = 0x691c0000 end_va = 0x69e18fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll") Region: id = 643 start_va = 0x8f0000 end_va = 0x8f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 644 start_va = 0x8f0000 end_va = 0x8f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 645 start_va = 0x4600000 end_va = 0x468efff monitored = 0 entry_point = 0x460dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 646 start_va = 0x69120000 end_va = 0x691b1fff monitored = 0 entry_point = 0x6912dd60 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll") Region: id = 647 start_va = 0x4600000 end_va = 0x47effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 648 start_va = 0x900000 end_va = 0x900fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 649 start_va = 0x4600000 end_va = 0x46bbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004600000" filename = "" Region: id = 650 start_va = 0x47e0000 end_va = 0x47effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047e0000" filename = "" Region: id = 651 start_va = 0x900000 end_va = 0x903fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 652 start_va = 0x960000 end_va = 0x963fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 653 start_va = 0x47f0000 end_va = 0x49fafff monitored = 0 entry_point = 0x489b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 654 start_va = 0x6efe0000 end_va = 0x6f1eefff monitored = 0 entry_point = 0x6f08b0a0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll") Region: id = 655 start_va = 0x970000 end_va = 0x970fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 656 start_va = 0x980000 end_va = 0x981fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000980000" filename = "" Region: id = 657 start_va = 0x47f0000 end_va = 0x492ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047f0000" filename = "" Region: id = 658 start_va = 0x70740000 end_va = 0x7075cfff monitored = 0 entry_point = 0x70743b10 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 659 start_va = 0x46c0000 end_va = 0x4721fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 660 start_va = 0x68fb0000 end_va = 0x6911afff monitored = 0 entry_point = 0x6901e360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 661 start_va = 0x47f0000 end_va = 0x48affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047f0000" filename = "" Region: id = 662 start_va = 0x4920000 end_va = 0x492ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004920000" filename = "" Region: id = 663 start_va = 0x4730000 end_va = 0x476ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004730000" filename = "" Region: id = 664 start_va = 0x4930000 end_va = 0x4a2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004930000" filename = "" Region: id = 665 start_va = 0x6d090000 end_va = 0x6d280fff monitored = 0 entry_point = 0x6d173cd0 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 666 start_va = 0x74470000 end_va = 0x7458efff monitored = 0 entry_point = 0x744b5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 667 start_va = 0x4770000 end_va = 0x47b8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 668 start_va = 0x970000 end_va = 0x973fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 669 start_va = 0x4a30000 end_va = 0x5a2ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 670 start_va = 0x47c0000 end_va = 0x47c3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047c0000" filename = "" Region: id = 671 start_va = 0x5a30000 end_va = 0x5b2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a30000" filename = "" Region: id = 672 start_va = 0x5b30000 end_va = 0x5c2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b30000" filename = "" Region: id = 673 start_va = 0x5c30000 end_va = 0x6121fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005c30000" filename = "" Region: id = 674 start_va = 0x6130000 end_va = 0x61ecfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 675 start_va = 0x61f0000 end_va = 0x65effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000061f0000" filename = "" Region: id = 676 start_va = 0x47d0000 end_va = 0x47d1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000047d0000" filename = "" Region: id = 677 start_va = 0x47f0000 end_va = 0x47f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000047f0000" filename = "" Region: id = 678 start_va = 0x4800000 end_va = 0x4804fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 679 start_va = 0x48a0000 end_va = 0x48affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048a0000" filename = "" Region: id = 680 start_va = 0x4810000 end_va = 0x4810fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004810000" filename = "" Region: id = 681 start_va = 0x751c0000 end_va = 0x7524cfff monitored = 0 entry_point = 0x75209b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 682 start_va = 0x4820000 end_va = 0x4820fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004820000" filename = "" Region: id = 683 start_va = 0x4830000 end_va = 0x4887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004830000" filename = "" Region: id = 684 start_va = 0x4890000 end_va = 0x4890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 685 start_va = 0x65f0000 end_va = 0x762ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 686 start_va = 0x6d720000 end_va = 0x6d732fff monitored = 0 entry_point = 0x6d729950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 687 start_va = 0x6ffd0000 end_va = 0x6fffefff monitored = 0 entry_point = 0x6ffe95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 688 start_va = 0x740f0000 end_va = 0x7410afff monitored = 0 entry_point = 0x740f9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 689 start_va = 0x48b0000 end_va = 0x48bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 690 start_va = 0x6a080000 end_va = 0x6a791fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll") Region: id = 691 start_va = 0x48c0000 end_va = 0x48cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 692 start_va = 0x48d0000 end_va = 0x48dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 693 start_va = 0x756e0000 end_va = 0x76adefff monitored = 0 entry_point = 0x7589b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 698 start_va = 0x75120000 end_va = 0x75156fff monitored = 0 entry_point = 0x75123b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 699 start_va = 0x749a0000 end_va = 0x74e98fff monitored = 0 entry_point = 0x74ba7610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 705 start_va = 0x75370000 end_va = 0x753b3fff monitored = 0 entry_point = 0x75377410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 706 start_va = 0x75250000 end_va = 0x7525efff monitored = 0 entry_point = 0x75252e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 709 start_va = 0x48b0000 end_va = 0x48bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 710 start_va = 0x7630000 end_va = 0x772ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007630000" filename = "" Region: id = 711 start_va = 0x48c0000 end_va = 0x48d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048c0000" filename = "" Region: id = 712 start_va = 0x68ec0000 end_va = 0x68faefff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\1b51e779650e38bb712f3e535efcf132\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\1b51e779650e38bb712f3e535efcf132\\system.configuration.ni.dll") Region: id = 713 start_va = 0x687a0000 end_va = 0x68eb5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\1f87b5140145c221b5201351fffc52d8\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\1f87b5140145c221b5201351fffc52d8\\system.xml.ni.dll") Region: id = 714 start_va = 0x69fd0000 end_va = 0x6a074fff monitored = 0 entry_point = 0x69feac50 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 715 start_va = 0x6cd00000 end_va = 0x6cd22fff monitored = 0 entry_point = 0x6cd05570 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 716 start_va = 0x6ccf0000 end_va = 0x6ccfffff monitored = 0 entry_point = 0x6ccf3820 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 717 start_va = 0x75310000 end_va = 0x7536efff monitored = 0 entry_point = 0x75314af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 718 start_va = 0x71f30000 end_va = 0x71f7efff monitored = 0 entry_point = 0x71f3d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 719 start_va = 0x7730000 end_va = 0x780ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 720 start_va = 0x48e0000 end_va = 0x491ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048e0000" filename = "" Region: id = 721 start_va = 0x7810000 end_va = 0x790ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007810000" filename = "" Region: id = 722 start_va = 0x70770000 end_va = 0x7080afff monitored = 0 entry_point = 0x707af7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 723 start_va = 0x7910000 end_va = 0x794ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007910000" filename = "" Region: id = 724 start_va = 0x7950000 end_va = 0x7a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007950000" filename = "" Region: id = 725 start_va = 0x70810000 end_va = 0x70821fff monitored = 0 entry_point = 0x70814510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 726 start_va = 0x71e70000 end_va = 0x71e9efff monitored = 0 entry_point = 0x71e7bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 727 start_va = 0x74980000 end_va = 0x74986fff monitored = 0 entry_point = 0x74981e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 728 start_va = 0x71df0000 end_va = 0x71e02fff monitored = 0 entry_point = 0x71df25d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 729 start_va = 0x71dd0000 end_va = 0x71de3fff monitored = 0 entry_point = 0x71dd3c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 730 start_va = 0x7a50000 end_va = 0x7a53fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a50000" filename = "" Region: id = 731 start_va = 0x7a60000 end_va = 0x7a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a60000" filename = "" Region: id = 732 start_va = 0x7aa0000 end_va = 0x7b9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007aa0000" filename = "" Region: id = 733 start_va = 0x7ba0000 end_va = 0x7bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ba0000" filename = "" Region: id = 734 start_va = 0x7be0000 end_va = 0x7cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007be0000" filename = "" Region: id = 735 start_va = 0x7ce0000 end_va = 0x7ce0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 736 start_va = 0x7ce0000 end_va = 0x7ce8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 737 start_va = 0x7ce0000 end_va = 0x7ce0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 738 start_va = 0x7ce0000 end_va = 0x7ce8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 739 start_va = 0x7ce0000 end_va = 0x7ce0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 740 start_va = 0x7ce0000 end_va = 0x7ce8fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 741 start_va = 0x7ce0000 end_va = 0x7d1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ce0000" filename = "" Region: id = 742 start_va = 0x7d20000 end_va = 0x7e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d20000" filename = "" Region: id = 743 start_va = 0x686c0000 end_va = 0x68793fff monitored = 1 entry_point = 0x686f3432 region_type = mapped_file name = "diasymreader.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\diasymreader.dll") Region: id = 744 start_va = 0x7e20000 end_va = 0x7e23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e20000" filename = "" Region: id = 745 start_va = 0x7e30000 end_va = 0x7e34fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll") Region: id = 746 start_va = 0x7e40000 end_va = 0x7e4ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui") Region: id = 747 start_va = 0x7e50000 end_va = 0x864ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1560258661-3990802383-1811730007-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat") Region: id = 748 start_va = 0x8650000 end_va = 0x865ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008650000" filename = "" Region: id = 749 start_va = 0x68540000 end_va = 0x686b2fff monitored = 0 entry_point = 0x685ed220 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 750 start_va = 0x8660000 end_va = 0x8660fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008660000" filename = "" Region: id = 751 start_va = 0x8660000 end_va = 0x86dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008660000" filename = "" Region: id = 752 start_va = 0x86e0000 end_va = 0x86e2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000086e0000" filename = "" Region: id = 753 start_va = 0x86e0000 end_va = 0x8728fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000086e0000" filename = "" Region: id = 754 start_va = 0x8730000 end_va = 0x8733fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008730000" filename = "" Region: id = 755 start_va = 0x8740000 end_va = 0x8740fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008740000" filename = "" Region: id = 756 start_va = 0x8750000 end_va = 0x8767fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008750000" filename = "" Region: id = 757 start_va = 0x8730000 end_va = 0x8736fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008730000" filename = "" Thread: id = 5 os_tid = 0xbf8 [0131.585] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0131.607] RoInitialize () returned 0x1 [0131.608] RoUninitialize () returned 0x0 [0133.054] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19ef18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0133.107] IsAppThemed () returned 0x1 [0133.110] CoTaskMemAlloc (cb=0xf0) returned 0x68b088 [0133.110] CreateActCtxA (pActCtx=0x19f414) returned 0x689cf4 [0133.222] CoTaskMemFree (pv=0x68b088) [0133.236] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc206 [0133.236] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc207 [0133.244] GetUserNameW (in: lpBuffer=0x19f25c, pcbBuffer=0x19f4d4 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f4d4) returned 1 [0133.248] GetComputerNameW (in: lpBuffer=0x19f25c, nSize=0x19f4d4 | out: lpBuffer="XC64ZB", nSize=0x19f4d4) returned 1 [0133.258] GetSystemMetrics (nIndex=75) returned 1 [0133.263] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0134.103] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x69120000 [0134.194] AdjustWindowRectEx (in: lpRect=0x19f474, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19f474) returned 1 [0134.197] GetCurrentProcess () returned 0xffffffff [0134.197] GetCurrentThread () returned 0xfffffffe [0134.197] GetCurrentProcess () returned 0xffffffff [0134.197] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f38c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f38c*=0x240) returned 1 [0134.202] GetCurrentThreadId () returned 0xbf8 [0134.218] GetCurrentActCtx (in: lphActCtx=0x19f2ec | out: lphActCtx=0x19f2ec*=0x0) returned 1 [0134.218] ActivateActCtx (in: hActCtx=0x689cf4, lpCookie=0x19f2fc | out: hActCtx=0x689cf4, lpCookie=0x19f2fc) returned 1 [0134.219] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0135.484] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6efe0000 [0135.497] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77450000 [0135.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19f1b4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW;iD?ÀB «@lhö\x19", lpUsedDefaultChar=0x0) returned 14 [0135.497] GetProcAddress (hModule=0x77450000, lpProcName="DefWindowProcW") returned 0x777aaee0 [0135.498] GetStockObject (i=5) returned 0x1900015 [0135.521] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0135.526] CoTaskMemAlloc (cb=0x5c) returned 0x6a4688 [0135.526] RegisterClassW (lpWndClass=0x19f1a4) returned 0xc150 [0135.527] CoTaskMemFree (pv=0x6a4688) [0135.527] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0135.528] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x9032e [0135.529] SetWindowLongW (hWnd=0x9032e, nIndex=-4, dwNewLong=2004528864) returned 76678590 [0135.546] GetWindowLongW (hWnd=0x9032e, nIndex=-4) returned 2004528864 [0135.552] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea04 | out: phkResult=0x19ea04*=0x260) returned 0x0 [0135.553] RegQueryValueExW (in: hKey=0x260, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19ea24, lpData=0x0, lpcbData=0x19ea20*=0x0 | out: lpType=0x19ea24*=0x0, lpData=0x0, lpcbData=0x19ea20*=0x0) returned 0x2 [0135.553] RegQueryValueExW (in: hKey=0x260, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19ea24, lpData=0x0, lpcbData=0x19ea20*=0x0 | out: lpType=0x19ea24*=0x0, lpData=0x0, lpcbData=0x19ea20*=0x0) returned 0x2 [0135.553] RegCloseKey (hKey=0x260) returned 0x0 [0135.556] SetWindowLongW (hWnd=0x9032e, nIndex=-4, dwNewLong=76678630) returned 2004528864 [0135.556] GetWindowLongW (hWnd=0x9032e, nIndex=-4) returned 76678630 [0135.556] GetWindowLongW (hWnd=0x9032e, nIndex=-16) returned 113311744 [0135.557] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1d1 [0135.558] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x9032e, Msg=0x24, wParam=0x0, lParam=0x19ed1c) returned 0x0 [0135.558] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1d2 [0135.558] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x9032e, Msg=0x81, wParam=0x0, lParam=0x19ed10) returned 0x1 [0135.559] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x9032e, Msg=0x83, wParam=0x0, lParam=0x19ecfc) returned 0x0 [0135.862] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x9032e, Msg=0x1, wParam=0x0, lParam=0x19ed10) returned 0x0 [0135.863] GetClientRect (in: hWnd=0x9032e, lpRect=0x19ea3c | out: lpRect=0x19ea3c) returned 1 [0135.863] GetWindowRect (in: hWnd=0x9032e, lpRect=0x19ea3c | out: lpRect=0x19ea3c) returned 1 [0135.865] GetParent (hWnd=0x9032e) returned 0x0 [0135.865] DeactivateActCtx (dwFlags=0x0, ulCookie=0x15af0001) returned 1 [0135.981] EtwEventRegister (in: ProviderId=0x21c8d8c, EnableCallback=0x492060e, CallbackContext=0x0, RegHandle=0x21c8d68 | out: RegHandle=0x21c8d68) returned 0x0 [0135.985] EtwEventSetInformation (RegHandle=0x6505c0, InformationClass=0x1f, EventInformation=0x2, InformationLength=0x21c8cfc) returned 0x0 [0135.991] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69120000 [0135.991] AdjustWindowRectEx (in: lpRect=0x19f460, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f460) returned 1 [0136.023] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19ed4c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0136.024] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", nBufferLength=0x105, lpBuffer=0x19ed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", lpFilePart=0x0) returned 0x3a [0136.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1f4) returned 1 [0136.027] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f270 | out: lpFileInformation=0x19f270*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0136.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0136.535] GetSystemMetrics (nIndex=11) returned 32 [0136.535] GetSystemMetrics (nIndex=12) returned 32 [0136.536] GetDC (hWnd=0x0) returned 0x50107d3 [0136.540] GetDeviceCaps (hdc=0x50107d3, index=12) returned 32 [0136.540] GetDeviceCaps (hdc=0x50107d3, index=14) returned 1 [0136.541] ReleaseDC (hWnd=0x0, hDC=0x50107d3) returned 1 [0136.541] CreateIconFromResourceEx (presbits=0x21dc1dc, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x53008f [0136.545] CreateCompatibleDC (hdc=0x0) returned 0x470108fc [0136.547] GetSystemDefaultLCID () returned 0x409 [0136.547] GetStockObject (i=17) returned 0x10a0047 [0136.550] GetObjectW (in: h=0x10a0047, c=92, pv=0x19f1b8 | out: pv=0x19f1b8) returned 92 [0136.550] GetDC (hWnd=0x0) returned 0x50107d3 [0137.368] GdiplusStartup (in: token=0x4b5e98, input=0x19e780, output=0x19e7d0 | out: token=0x4b5e98, output=0x19e7d0) returned 0x0 [0137.377] CoTaskMemAlloc (cb=0x5c) returned 0x6a41a8 [0137.379] GdipCreateFontFromLogfontW (hdc=0x50107d3, logfont=0x6a41a8, font=0x19f280) returned 0x0 [0138.689] CoTaskMemFree (pv=0x6a41a8) [0138.690] CoTaskMemAlloc (cb=0x5c) returned 0x6a4620 [0138.691] CoTaskMemFree (pv=0x6a4620) [0138.691] CoTaskMemAlloc (cb=0x5c) returned 0x6a42e0 [0138.691] CoTaskMemFree (pv=0x6a42e0) [0138.691] GdipGetFontUnit (font=0x48a1f08, unit=0x19f24c) returned 0x0 [0138.692] GdipGetFontSize (font=0x48a1f08, size=0x19f250) returned 0x0 [0138.715] GdipGetFontStyle (font=0x48a1f08, style=0x19f248) returned 0x0 [0138.715] GdipGetFamily (font=0x48a1f08, family=0x19f244) returned 0x0 [0138.716] GdipGetFontSize (font=0x48a1f08, size=0x21dd748) returned 0x0 [0138.716] ReleaseDC (hWnd=0x0, hDC=0x50107d3) returned 1 [0138.717] GetDC (hWnd=0x0) returned 0x9010784 [0138.717] GdipCreateFromHDC (hdc=0x9010784, graphics=0x19f26c) returned 0x0 [0138.724] GdipGetDpiY (graphics=0x5b3f268, dpi=0x21dd850) returned 0x0 [0138.724] GdipGetFontHeight (font=0x48a1f08, graphics=0x5b3f268, height=0x19f264) returned 0x0 [0138.725] GdipGetEmHeight (family=0x5b350a0, style=0, EmHeight=0x19f26c) returned 0x0 [0138.725] GdipGetLineSpacing (family=0x5b350a0, style=0, LineSpacing=0x19f26c) returned 0x0 [0138.726] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0 [0138.727] ReleaseDC (hWnd=0x0, hDC=0x9010784) returned 1 [0138.728] GdipCreateFont (fontFamily=0x5b350a0, emSize=0x41040000, style=0, unit=0x3, font=0x21dd810) returned 0x0 [0138.728] GdipGetFontSize (font=0x48aefc0, size=0x21dd814) returned 0x0 [0138.728] GdipDeleteFont (font=0x48a1f08) returned 0x0 [0138.728] GetDC (hWnd=0x0) returned 0x9010784 [0138.729] GdipCreateFromHDC (hdc=0x9010784, graphics=0x19f290) returned 0x0 [0138.729] CoTaskMemAlloc (cb=0x5c) returned 0x6a4278 [0138.731] GdipGetLogFontW (font=0x48aefc0, graphics=0x5b3f268, logfontW=0x6a4278) returned 0x0 [0138.735] CoTaskMemFree (pv=0x6a4278) [0138.735] CoTaskMemAlloc (cb=0x5c) returned 0x6a4418 [0138.736] CoTaskMemFree (pv=0x6a4418) [0138.736] CoTaskMemAlloc (cb=0x5c) returned 0x6a42e0 [0138.736] CoTaskMemFree (pv=0x6a42e0) [0138.736] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0 [0138.736] ReleaseDC (hWnd=0x0, hDC=0x9010784) returned 1 [0138.767] CoTaskMemAlloc (cb=0x5c) returned 0x6a40d8 [0138.768] CreateFontIndirectW (lplf=0x6a40d8) returned 0x3a0a09ab [0138.768] CoTaskMemFree (pv=0x6a40d8) [0138.768] SelectObject (hdc=0x470108fc, h=0x3a0a09ab) returned 0x18a0048 [0138.769] GetTextMetricsW (in: hdc=0x470108fc, lptm=0x19f39c | out: lptm=0x19f39c) returned 1 [0138.769] GetTextExtentPoint32W (in: hdc=0x470108fc, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x21dda6c | out: psizl=0x21dda6c) returned 1 [0138.771] SelectObject (hdc=0x470108fc, h=0x18a0048) returned 0x3a0a09ab [0138.773] DeleteDC (hdc=0x470108fc) returned 1 [0138.774] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69120000 [0138.774] AdjustWindowRectEx (in: lpRect=0x19f108, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f108) returned 1 [0138.774] AdjustWindowRectEx (in: lpRect=0x19f328, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f328) returned 1 [0138.775] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69120000 [0138.775] AdjustWindowRectEx (in: lpRect=0x19f080, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f080) returned 1 [0138.775] AdjustWindowRectEx (in: lpRect=0x19f160, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f160) returned 1 [0138.776] GetSystemMetrics (nIndex=34) returned 136 [0138.776] GetSystemMetrics (nIndex=35) returned 39 [0138.777] GetCurrentActCtx (in: lphActCtx=0x19f48c | out: lphActCtx=0x19f48c*=0x0) returned 1 [0138.777] ActivateActCtx (in: hActCtx=0x689cf4, lpCookie=0x19f49c | out: hActCtx=0x689cf4, lpCookie=0x19f49c) returned 1 [0138.777] GetCurrentActCtx (in: lphActCtx=0x19f2ac | out: lphActCtx=0x19f2ac*=0x689cf4) returned 1 [0138.778] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0138.778] AdjustWindowRectEx (in: lpRect=0x19f210, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f210) returned 1 [0138.778] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0138.778] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="notepad", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=300, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x601fc [0138.779] SetWindowLongW (hWnd=0x601fc, nIndex=-4, dwNewLong=2004528864) returned 76678590 [0138.779] GetWindowLongW (hWnd=0x601fc, nIndex=-4) returned 2004528864 [0138.780] SetWindowLongW (hWnd=0x601fc, nIndex=-4, dwNewLong=76678710) returned 2004528864 [0138.780] GetWindowLongW (hWnd=0x601fc, nIndex=-4) returned 76678710 [0138.780] GetWindowLongW (hWnd=0x601fc, nIndex=-16) returned 114229248 [0138.780] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x81, wParam=0x0, lParam=0x19ecd0) returned 0x1 [0138.783] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x83, wParam=0x0, lParam=0x19ecbc) returned 0x0 [0138.785] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x1, wParam=0x0, lParam=0x19ecd0) returned 0x0 [0138.785] GetClientRect (in: hWnd=0x601fc, lpRect=0x19e9cc | out: lpRect=0x19e9cc) returned 1 [0138.785] GetWindowRect (in: hWnd=0x601fc, lpRect=0x19e9cc | out: lpRect=0x19e9cc) returned 1 [0138.786] SetWindowTextW (hWnd=0x601fc, lpString="notepad") returned 1 [0138.786] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xc, wParam=0x0, lParam=0x21c89e0) returned 0x1 [0138.800] GetProcessWindowStation () returned 0xd0 [0138.804] GetUserObjectInformationA (in: hObj=0xd0, nIndex=1, pvInfo=0x21ddf88, nLength=0xc, lpnLengthNeeded=0x19e8cc | out: pvInfo=0x21ddf88, lpnLengthNeeded=0x19e8cc) returned 1 [0138.808] SetConsoleCtrlHandler (HandlerRoutine=0x492065e, Add=1) returned 1 [0138.809] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0138.811] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0138.813] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x21ddfec | out: lpWndClass=0x21ddfec) returned 0 [0138.816] CoTaskMemAlloc (cb=0x58) returned 0x68cb88 [0138.816] RegisterClassW (lpWndClass=0x19e81c) returned 0xc208 [0138.816] CoTaskMemFree (pv=0x68cb88) [0138.818] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x40200 [0138.818] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x81, wParam=0x0, lParam=0x19e358) returned 0x1 [0138.819] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x83, wParam=0x0, lParam=0x19e344) returned 0x0 [0138.820] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x1, wParam=0x0, lParam=0x19e358) returned 0x0 [0138.820] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0138.820] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0138.825] GetStartupInfoW (in: lpStartupInfo=0x21de440 | out: lpStartupInfo=0x21de440*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0138.826] GetParent (hWnd=0x601fc) returned 0x0 [0138.826] SetWindowLongW (hWnd=0x601fc, nIndex=-8, dwNewLong=0) returned 0 [0138.829] GetSystemMetrics (nIndex=49) returned 16 [0138.829] GetSystemMetrics (nIndex=50) returned 16 [0138.829] CreateIconFromResourceEx (presbits=0x21de4c0, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xb0205 [0138.831] SendMessageW (hWnd=0x601fc, Msg=0x80, wParam=0x0, lParam=0xb0205) returned 0x0 [0138.831] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x80, wParam=0x0, lParam=0xb0205) returned 0x0 [0138.832] SendMessageW (hWnd=0x601fc, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0 [0138.832] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0 [0138.832] GetSystemMenu (hWnd=0x601fc, bRevert=0) returned 0x80139 [0138.850] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19f2bc | out: lpwndpl=0x19f2bc) returned 1 [0138.850] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0138.851] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0138.851] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0138.851] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0138.851] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0138.851] GetClientRect (in: hWnd=0x601fc, lpRect=0x19f300 | out: lpRect=0x19f300) returned 1 [0138.851] GetClientRect (in: hWnd=0x601fc, lpRect=0x19f260 | out: lpRect=0x19f260) returned 1 [0138.851] GetWindowRect (in: hWnd=0x601fc, lpRect=0x19f260 | out: lpRect=0x19f260) returned 1 [0138.852] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0138.894] GetWindowLongW (hWnd=0x601fc, nIndex=-16) returned 114229248 [0138.894] GetWindowTextLengthW (hWnd=0x601fc) returned 7 [0138.894] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0138.894] GetSystemMetrics (nIndex=42) returned 0 [0138.895] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19f200, nMaxCount=8 | out: lpString="notepad") returned 7 [0138.895] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19f200) returned 0x7 [0138.896] GetWindowTextLengthW (hWnd=0x601fc) returned 7 [0138.896] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0138.896] GetSystemMetrics (nIndex=42) returned 0 [0138.896] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19f200, nMaxCount=8 | out: lpString="notepad") returned 7 [0138.896] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19f200) returned 0x7 [0138.896] GetWindowLongW (hWnd=0x601fc, nIndex=-16) returned 114229248 [0138.896] GetWindowLongW (hWnd=0x601fc, nIndex=-20) returned 327936 [0138.897] SetWindowLongW (hWnd=0x601fc, nIndex=-16, dwNewLong=47120384) returned 114229248 [0138.897] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7c, wParam=0xfffffff0, lParam=0x19f254) returned 0x0 [0138.897] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7d, wParam=0xfffffff0, lParam=0x19f254) returned 0x0 [0138.926] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0xb0205 [0138.927] SetWindowLongW (hWnd=0x601fc, nIndex=-20, dwNewLong=327680) returned 327936 [0138.927] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7c, wParam=0xffffffec, lParam=0x19f254) returned 0x0 [0138.928] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7d, wParam=0xffffffec, lParam=0x19f254) returned 0x0 [0138.930] SetWindowPos (hWnd=0x601fc, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0138.930] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x46, wParam=0x0, lParam=0x19f274) returned 0x0 [0138.930] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x83, wParam=0x1, lParam=0x19f24c) returned 0x0 [0138.937] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19efe4 | out: lpwndpl=0x19efe4) returned 1 [0138.937] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x47, wParam=0x0, lParam=0x19f274) returned 0x0 [0138.937] GetClientRect (in: hWnd=0x601fc, lpRect=0x19ef94 | out: lpRect=0x19ef94) returned 1 [0138.937] GetWindowRect (in: hWnd=0x601fc, lpRect=0x19ef94 | out: lpRect=0x19ef94) returned 1 [0138.939] RedrawWindow (hWnd=0x601fc, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0138.939] GetSystemMenu (hWnd=0x601fc, bRevert=0) returned 0x80139 [0138.939] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19f2ac | out: lpwndpl=0x19f2ac) returned 1 [0138.939] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0138.940] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0138.940] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0138.940] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0138.940] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0138.940] ShowWindow (hWnd=0x601fc, nCmdShow=5) returned 0 [0138.940] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0138.944] GetWindowTextLengthW (hWnd=0x601fc) returned 7 [0138.944] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0138.944] GetSystemMetrics (nIndex=42) returned 0 [0138.944] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19eee8, nMaxCount=8 | out: lpString="notepad") returned 7 [0138.944] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19eee8) returned 0x7 [0138.965] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0138.966] GetWindowLongW (hWnd=0x601fc, nIndex=-16) returned 114229248 [0138.966] GetWindowTextLengthW (hWnd=0x601fc) returned 7 [0138.966] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0138.966] GetSystemMetrics (nIndex=42) returned 0 [0138.966] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19edec, nMaxCount=8 | out: lpString="notepad") returned 7 [0138.966] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19edec) returned 0x7 [0138.966] GetWindowTextLengthW (hWnd=0x601fc) returned 7 [0138.966] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0138.966] GetSystemMetrics (nIndex=42) returned 0 [0138.967] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19edec, nMaxCount=8 | out: lpString="notepad") returned 7 [0138.967] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19edec) returned 0x7 [0138.967] GetWindowLongW (hWnd=0x601fc, nIndex=-16) returned 114229248 [0138.967] GetWindowLongW (hWnd=0x601fc, nIndex=-20) returned 327936 [0138.967] SetWindowLongW (hWnd=0x601fc, nIndex=-16, dwNewLong=315555840) returned 114229248 [0138.967] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7c, wParam=0xfffffff0, lParam=0x19ee44) returned 0x0 [0138.993] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7d, wParam=0xfffffff0, lParam=0x19ee44) returned 0x0 [0138.994] SetWindowLongW (hWnd=0x601fc, nIndex=-20, dwNewLong=851968) returned 327936 [0138.994] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7c, wParam=0xffffffec, lParam=0x19ee44) returned 0x0 [0138.995] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7d, wParam=0xffffffec, lParam=0x19ee44) returned 0x0 [0139.001] SetWindowPos (hWnd=0x601fc, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0139.002] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x46, wParam=0x0, lParam=0x19ee64) returned 0x0 [0139.002] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x83, wParam=0x1, lParam=0x19ee3c) returned 0x0 [0139.004] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x85, wParam=0xe0408e2, lParam=0x0) returned 0x0 [0139.005] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19ebf0 | out: lpwndpl=0x19ebf0) returned 1 [0139.006] GetClientRect (in: hWnd=0x601fc, lpRect=0x19eb9c | out: lpRect=0x19eb9c) returned 1 [0139.006] GetWindowTextLengthW (hWnd=0x601fc) returned 7 [0139.006] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0139.006] GetSystemMetrics (nIndex=42) returned 0 [0139.006] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19ea64, nMaxCount=8 | out: lpString="notepad") returned 7 [0139.006] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19ea64) returned 0x7 [0139.006] GetClientRect (in: hWnd=0x601fc, lpRect=0x19eaa4 | out: lpRect=0x19eaa4) returned 1 [0139.018] GetSysColor (nIndex=10) returned 0xb4b4b4 [0139.018] GetSysColor (nIndex=2) returned 0xd1b499 [0139.018] GetSysColor (nIndex=9) returned 0x0 [0139.018] GetSysColor (nIndex=12) returned 0xababab [0139.018] GetSysColor (nIndex=15) returned 0xf0f0f0 [0139.018] GetSysColor (nIndex=20) returned 0xffffff [0139.018] GetSysColor (nIndex=16) returned 0xa0a0a0 [0139.018] GetSysColor (nIndex=15) returned 0xf0f0f0 [0139.018] GetSysColor (nIndex=16) returned 0xa0a0a0 [0139.019] GetSysColor (nIndex=21) returned 0x696969 [0139.019] GetSysColor (nIndex=22) returned 0xe3e3e3 [0139.019] GetSysColor (nIndex=20) returned 0xffffff [0139.019] GetSysColor (nIndex=18) returned 0x0 [0139.019] GetSysColor (nIndex=1) returned 0x0 [0139.019] GetSysColor (nIndex=27) returned 0xead1b9 [0139.019] GetSysColor (nIndex=28) returned 0xf2e4d7 [0139.019] GetSysColor (nIndex=17) returned 0x6d6d6d [0139.019] GetSysColor (nIndex=13) returned 0xff9933 [0139.019] GetSysColor (nIndex=14) returned 0xffffff [0139.019] GetSysColor (nIndex=26) returned 0xcc6600 [0139.019] GetSysColor (nIndex=11) returned 0xfcf7f4 [0139.019] GetSysColor (nIndex=3) returned 0xdbcdbf [0139.019] GetSysColor (nIndex=19) returned 0x0 [0139.020] GetSysColor (nIndex=24) returned 0xe1ffff [0139.020] GetSysColor (nIndex=23) returned 0x0 [0139.020] GetSysColor (nIndex=4) returned 0xf0f0f0 [0139.020] GetSysColor (nIndex=30) returned 0xf0f0f0 [0139.020] GetSysColor (nIndex=29) returned 0xff9933 [0139.020] GetSysColor (nIndex=7) returned 0x0 [0139.020] GetSysColor (nIndex=0) returned 0xc8c8c8 [0139.020] GetSysColor (nIndex=5) returned 0xffffff [0139.020] GetSysColor (nIndex=6) returned 0x646464 [0139.020] GetSysColor (nIndex=8) returned 0x0 [0139.022] GetSystemMetrics (nIndex=80) returned 1 [0139.031] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x49206ae, dwData=0x0) returned 1 [0139.042] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e704 | out: lpmi=0x19e704) returned 1 [0139.044] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x24010999 [0139.044] GetDeviceCaps (hdc=0x24010999, index=12) returned 32 [0139.045] GetDeviceCaps (hdc=0x24010999, index=14) returned 1 [0139.045] DeleteDC (hdc=0x24010999) returned 1 [0139.045] GetCurrentObject (hdc=0xd001053c, type=0x1) returned 0x1b00017 [0139.045] GetCurrentObject (hdc=0xd001053c, type=0x2) returned 0x1900010 [0139.046] GetCurrentObject (hdc=0xd001053c, type=0x7) returned 0x350506d2 [0139.046] GetCurrentObject (hdc=0xd001053c, type=0x6) returned 0x18a0048 [0139.046] SaveDC (hdc=0xd001053c) returned 1 [0139.047] GetNearestColor (hdc=0xd001053c, color=0xf0f0f0) returned 0xf0f0f0 [0139.048] CreateSolidBrush (color=0xf0f0f0) returned 0xc1008ec [0139.049] FillRect (hDC=0xd001053c, lprc=0x19e944, hbr=0xc1008ec) returned 1 [0139.050] DeleteObject (ho=0xc1008ec) returned 1 [0139.050] RestoreDC (hdc=0xd001053c, nSavedDC=-1) returned 1 [0139.051] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19ebd4 | out: lpwndpl=0x19ebd4) returned 1 [0139.052] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x47, wParam=0x0, lParam=0x19ee64) returned 0x0 [0139.052] GetClientRect (in: hWnd=0x601fc, lpRect=0x19eb84 | out: lpRect=0x19eb84) returned 1 [0139.052] GetWindowRect (in: hWnd=0x601fc, lpRect=0x19eb84 | out: lpRect=0x19eb84) returned 1 [0139.053] RedrawWindow (hWnd=0x601fc, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0139.054] GetSystemMenu (hWnd=0x601fc, bRevert=0) returned 0x80139 [0139.054] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19ee98 | out: lpwndpl=0x19ee98) returned 1 [0139.054] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0139.054] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0139.054] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0139.054] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0139.054] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0139.193] SetLayeredWindowAttributes (hwnd=0x601fc, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0139.207] GetCurrentThreadId () returned 0xbf8 [0139.227] EnumThreadWindows (dwThreadId=0xbf8, lpfn=0x49206d6, lParam=0x601fc) returned 1 [0139.339] GetWindowLongW (hWnd=0x40200, nIndex=-8) returned 0 [0139.339] GetWindowLongW (hWnd=0x601fc, nIndex=-8) returned 0 [0139.339] GetWindowLongW (hWnd=0xc01e4, nIndex=-8) returned 393724 [0139.502] SetWindowLongW (hWnd=0xc01e4, nIndex=-8, dwNewLong=0) returned 393724 [0139.515] GetFocus () returned 0x0 [0139.515] GetParent (hWnd=0x601fc) returned 0x0 [0139.515] GetWindowLongW (hWnd=0x601fc, nIndex=-20) returned 852224 [0139.516] DestroyWindow (hWnd=0x601fc) returned 1 [0139.517] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0139.538] GetWindowTextLengthW (hWnd=0x601fc) returned 7 [0139.538] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0139.538] GetSystemMetrics (nIndex=42) returned 0 [0139.538] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19e9e8, nMaxCount=8 | out: lpString="notepad") returned 7 [0139.538] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19e9e8) returned 0x7 [0139.545] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0139.546] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0139.549] GetCurrentActCtx (in: lphActCtx=0x19edf8 | out: lphActCtx=0x19edf8*=0x689cf4) returned 1 [0139.549] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0139.550] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0139.550] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="notepad", dwStyle=0x2cf0000, X=156, Y=156, nWidth=300, nHeight=300, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x802a2 [0139.550] SetWindowLongW (hWnd=0x802a2, nIndex=-4, dwNewLong=2004528864) returned 76678590 [0139.551] GetWindowLongW (hWnd=0x802a2, nIndex=-4) returned 2004528864 [0139.552] SetWindowLongW (hWnd=0x802a2, nIndex=-4, dwNewLong=76678910) returned 2004528864 [0139.552] GetWindowLongW (hWnd=0x802a2, nIndex=-4) returned 76678910 [0139.552] GetWindowLongW (hWnd=0x802a2, nIndex=-16) returned 114229248 [0139.554] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x81, wParam=0x0, lParam=0x19e818) returned 0x1 [0139.560] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x83, wParam=0x0, lParam=0x19e804) returned 0x0 [0139.561] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x1, wParam=0x0, lParam=0x19e818) returned 0x0 [0139.561] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e514 | out: lpRect=0x19e514) returned 1 [0139.561] GetWindowRect (in: hWnd=0x802a2, lpRect=0x19e514 | out: lpRect=0x19e514) returned 1 [0139.562] SetWindowTextW (hWnd=0x802a2, lpString="notepad") returned 1 [0139.562] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xc, wParam=0x0, lParam=0x21df8a8) returned 0x1 [0139.562] SetLayeredWindowAttributes (hwnd=0x802a2, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0139.570] GetStartupInfoW (in: lpStartupInfo=0x21dfb7c | out: lpStartupInfo=0x21dfb7c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0139.572] GetParent (hWnd=0x802a2) returned 0x0 [0139.572] GetStockObject (i=5) returned 0x1900015 [0139.573] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0139.573] CoTaskMemAlloc (cb=0x5c) returned 0x6a4620 [0139.573] RegisterClassW (lpWndClass=0x19ecd8) returned 0xc209 [0139.573] CoTaskMemFree (pv=0x6a4620) [0139.574] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0139.574] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x7032c [0139.574] SetWindowLongW (hWnd=0x7032c, nIndex=-4, dwNewLong=2004528864) returned 76678950 [0139.574] GetWindowLongW (hWnd=0x7032c, nIndex=-4) returned 2004528864 [0139.575] SetWindowLongW (hWnd=0x7032c, nIndex=-4, dwNewLong=76678990) returned 2004528864 [0139.575] GetWindowLongW (hWnd=0x7032c, nIndex=-4) returned 76678990 [0139.575] GetWindowLongW (hWnd=0x7032c, nIndex=-16) returned 79691776 [0139.576] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x24, wParam=0x0, lParam=0x19e84c) returned 0x0 [0139.576] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x81, wParam=0x0, lParam=0x19e840) returned 0x1 [0139.577] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x83, wParam=0x0, lParam=0x19e82c) returned 0x0 [0139.578] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x1, wParam=0x0, lParam=0x19e840) returned 0x0 [0139.579] SetWindowLongW (hWnd=0x802a2, nIndex=-8, dwNewLong=459564) returned 0 [0139.582] SendMessageW (hWnd=0x802a2, Msg=0x80, wParam=0x0, lParam=0xb0205) returned 0x0 [0139.582] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x80, wParam=0x0, lParam=0xb0205) returned 0x0 [0139.582] SendMessageW (hWnd=0x802a2, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0 [0139.582] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0 [0139.583] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0xb0205 [0139.665] GetSystemMenu (hWnd=0x802a2, bRevert=0) returned 0x90139 [0139.666] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19ee08 | out: lpwndpl=0x19ee08) returned 1 [0139.666] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0139.666] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0139.666] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0139.666] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0139.666] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0139.666] GetClientRect (in: hWnd=0x802a2, lpRect=0x19ee4c | out: lpRect=0x19ee4c) returned 1 [0139.666] GetClientRect (in: hWnd=0x802a2, lpRect=0x19edac | out: lpRect=0x19edac) returned 1 [0139.666] GetWindowRect (in: hWnd=0x802a2, lpRect=0x19edac | out: lpRect=0x19edac) returned 1 [0139.666] SetWindowPos (hWnd=0x802a2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0139.666] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x46, wParam=0x0, lParam=0x19ed14) returned 0x0 [0139.675] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0139.678] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19eaa0 | out: lpwndpl=0x19eaa0) returned 1 [0139.678] GetClientRect (in: hWnd=0x802a2, lpRect=0x19ea4c | out: lpRect=0x19ea4c) returned 1 [0139.678] GetWindowTextLengthW (hWnd=0x802a2) returned 7 [0139.678] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0139.678] GetSystemMetrics (nIndex=42) returned 0 [0139.678] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e914, nMaxCount=8 | out: lpString="notepad") returned 7 [0139.678] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e914) returned 0x7 [0139.678] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e954 | out: lpRect=0x19e954) returned 1 [0139.678] GetCurrentObject (hdc=0xd001053c, type=0x1) returned 0x1b00017 [0139.678] GetCurrentObject (hdc=0xd001053c, type=0x2) returned 0x1900010 [0139.678] GetCurrentObject (hdc=0xd001053c, type=0x7) returned 0x360506d2 [0139.678] GetCurrentObject (hdc=0xd001053c, type=0x6) returned 0x18a0048 [0139.678] SaveDC (hdc=0xd001053c) returned 1 [0139.679] GetNearestColor (hdc=0xd001053c, color=0xf0f0f0) returned 0xf0f0f0 [0139.679] CreateSolidBrush (color=0xf0f0f0) returned 0xd1008ec [0139.679] FillRect (hDC=0xd001053c, lprc=0x19e7f4, hbr=0xd1008ec) returned 1 [0139.679] DeleteObject (ho=0xd1008ec) returned 1 [0139.679] RestoreDC (hdc=0xd001053c, nSavedDC=-1) returned 1 [0139.680] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19ea84 | out: lpwndpl=0x19ea84) returned 1 [0139.680] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x47, wParam=0x0, lParam=0x19ed14) returned 0x0 [0139.680] GetClientRect (in: hWnd=0x802a2, lpRect=0x19ea34 | out: lpRect=0x19ea34) returned 1 [0139.680] GetWindowRect (in: hWnd=0x802a2, lpRect=0x19ea34 | out: lpRect=0x19ea34) returned 1 [0139.683] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x83, wParam=0x1, lParam=0x19e864) returned 0x0 [0139.696] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0139.701] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19e618 | out: lpwndpl=0x19e618) returned 1 [0139.701] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e5c4 | out: lpRect=0x19e5c4) returned 1 [0139.701] GetWindowTextLengthW (hWnd=0x802a2) returned 7 [0139.701] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0139.704] GetSystemMetrics (nIndex=42) returned 0 [0139.704] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e48c, nMaxCount=8 | out: lpString="notepad") returned 7 [0139.705] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e48c) returned 0x7 [0139.705] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e4cc | out: lpRect=0x19e4cc) returned 1 [0139.705] GetCurrentObject (hdc=0x110106ca, type=0x1) returned 0x1b00017 [0139.705] GetCurrentObject (hdc=0x110106ca, type=0x2) returned 0x1900010 [0139.705] GetCurrentObject (hdc=0x110106ca, type=0x7) returned 0x360506d2 [0139.705] GetCurrentObject (hdc=0x110106ca, type=0x6) returned 0x18a0048 [0139.705] SaveDC (hdc=0x110106ca) returned 1 [0139.705] GetNearestColor (hdc=0x110106ca, color=0xf0f0f0) returned 0xf0f0f0 [0139.705] CreateSolidBrush (color=0xf0f0f0) returned 0xe1008ec [0139.706] FillRect (hDC=0x110106ca, lprc=0x19e36c, hbr=0xe1008ec) returned 1 [0139.706] DeleteObject (ho=0xe1008ec) returned 1 [0139.706] RestoreDC (hdc=0x110106ca, nSavedDC=-1) returned 1 [0139.707] SetWindowLongW (hWnd=0x802a2, nIndex=-8, dwNewLong=459564) returned 459564 [0139.708] SendMessageW (hWnd=0x7032c, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0 [0139.708] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0 [0139.711] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0139.711] GetWindowLongW (hWnd=0x802a2, nIndex=-16) returned 382664704 [0139.711] GetWindowTextLengthW (hWnd=0x802a2) returned 7 [0139.711] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0139.711] GetSystemMetrics (nIndex=42) returned 0 [0139.711] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19ed4c, nMaxCount=8 | out: lpString="notepad") returned 7 [0139.711] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19ed4c) returned 0x7 [0139.712] GetWindowTextLengthW (hWnd=0x802a2) returned 7 [0139.712] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0139.712] GetSystemMetrics (nIndex=42) returned 0 [0139.712] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19ed4c, nMaxCount=8 | out: lpString="notepad") returned 7 [0139.712] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19ed4c) returned 0x7 [0139.712] GetWindowLongW (hWnd=0x802a2, nIndex=-16) returned 382664704 [0139.712] GetWindowLongW (hWnd=0x802a2, nIndex=-20) returned 590080 [0139.712] SetWindowLongW (hWnd=0x802a2, nIndex=-16, dwNewLong=315555840) returned 382664704 [0139.712] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x7c, wParam=0xfffffff0, lParam=0x19eda4) returned 0x0 [0139.713] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x7d, wParam=0xfffffff0, lParam=0x19eda4) returned 0x0 [0139.714] SetWindowLongW (hWnd=0x802a2, nIndex=-20, dwNewLong=589824) returned 590080 [0139.715] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x7c, wParam=0xffffffec, lParam=0x19eda4) returned 0x0 [0139.715] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x7d, wParam=0xffffffec, lParam=0x19eda4) returned 0x0 [0139.733] SetWindowPos (hWnd=0x802a2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0139.733] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x46, wParam=0x0, lParam=0x19edc4) returned 0x0 [0139.734] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x83, wParam=0x1, lParam=0x19ed9c) returned 0x0 [0139.737] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0139.741] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19eb50 | out: lpwndpl=0x19eb50) returned 1 [0139.741] GetClientRect (in: hWnd=0x802a2, lpRect=0x19eafc | out: lpRect=0x19eafc) returned 1 [0139.741] GetWindowTextLengthW (hWnd=0x802a2) returned 7 [0139.741] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0139.741] GetSystemMetrics (nIndex=42) returned 0 [0139.741] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e9c4, nMaxCount=8 | out: lpString="notepad") returned 7 [0139.741] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e9c4) returned 0x7 [0139.741] GetClientRect (in: hWnd=0x802a2, lpRect=0x19ea04 | out: lpRect=0x19ea04) returned 1 [0139.741] GetCurrentObject (hdc=0x110106ca, type=0x1) returned 0x1b00017 [0139.741] GetCurrentObject (hdc=0x110106ca, type=0x2) returned 0x1900010 [0139.741] GetCurrentObject (hdc=0x110106ca, type=0x7) returned 0x360506d2 [0139.742] GetCurrentObject (hdc=0x110106ca, type=0x6) returned 0x18a0048 [0139.742] SaveDC (hdc=0x110106ca) returned 1 [0139.742] GetNearestColor (hdc=0x110106ca, color=0xf0f0f0) returned 0xf0f0f0 [0139.742] CreateSolidBrush (color=0xf0f0f0) returned 0xf1008ec [0139.742] FillRect (hDC=0x110106ca, lprc=0x19e8a4, hbr=0xf1008ec) returned 1 [0139.742] DeleteObject (ho=0xf1008ec) returned 1 [0139.742] RestoreDC (hdc=0x110106ca, nSavedDC=-1) returned 1 [0139.743] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19eb34 | out: lpwndpl=0x19eb34) returned 1 [0139.743] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x47, wParam=0x0, lParam=0x19edc4) returned 0x0 [0139.743] GetClientRect (in: hWnd=0x802a2, lpRect=0x19eae4 | out: lpRect=0x19eae4) returned 1 [0139.743] GetWindowRect (in: hWnd=0x802a2, lpRect=0x19eae4 | out: lpRect=0x19eae4) returned 1 [0139.745] RedrawWindow (hWnd=0x802a2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0139.745] GetSystemMenu (hWnd=0x802a2, bRevert=0) returned 0x90139 [0139.745] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19edf8 | out: lpwndpl=0x19edf8) returned 1 [0139.745] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0139.745] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0139.745] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0139.745] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0139.745] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0139.746] SetWindowLongW (hWnd=0xc01e4, nIndex=-8, dwNewLong=524962) returned 262656 [0140.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1 [0140.236] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0140.238] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpFilePart=0x0) returned 0x1e [0140.240] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf18745d5, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0xf18745d5, ftLastWriteTime.dwHighDateTime=0x1d8589f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68fde0 [0140.244] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf18745d5, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0xf18745d5, ftLastWriteTime.dwHighDateTime=0x1d8589f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.245] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75469f50, ftCreationTime.dwHighDateTime=0x1d828d4, ftLastAccessTime.dwLowDateTime=0x70383f70, ftLastAccessTime.dwHighDateTime=0x1d82995, ftLastWriteTime.dwLowDateTime=0x70383f70, ftLastWriteTime.dwHighDateTime=0x1d82995, nFileSizeHigh=0x0, nFileSizeLow=0x723e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2BCq2zisH1tDLrOOSW.csv", cAlternateFileName="2BCQ2Z~1.CSV")) returned 1 [0140.246] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1027c60, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0xd8eca900, ftLastAccessTime.dwHighDateTime=0x1d82a23, ftLastWriteTime.dwLowDateTime=0xd8eca900, ftLastWriteTime.dwHighDateTime=0x1d82a23, nFileSizeHigh=0x0, nFileSizeLow=0x2103, dwReserved0=0x0, dwReserved1=0x0, cFileName="438nbzlkP EaX9m.flv", cAlternateFileName="438NBZ~1.FLV")) returned 1 [0140.246] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf64e39c0, ftCreationTime.dwHighDateTime=0x1d82576, ftLastAccessTime.dwLowDateTime=0x98e694d0, ftLastAccessTime.dwHighDateTime=0x1d827e2, ftLastWriteTime.dwLowDateTime=0x98e694d0, ftLastWriteTime.dwHighDateTime=0x1d827e2, nFileSizeHigh=0x0, nFileSizeLow=0x1697, dwReserved0=0x0, dwReserved1=0x0, cFileName="80TvEOvTr5nvyl.swf", cAlternateFileName="80TVEO~1.SWF")) returned 1 [0140.246] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109394f0, ftCreationTime.dwHighDateTime=0x1d82631, ftLastAccessTime.dwLowDateTime=0x42022320, ftLastAccessTime.dwHighDateTime=0x1d827e5, ftLastWriteTime.dwLowDateTime=0x42022320, ftLastWriteTime.dwHighDateTime=0x1d827e5, nFileSizeHigh=0x0, nFileSizeLow=0x14bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="87ZhhWQhavO-.mkv", cAlternateFileName="87ZHHW~1.MKV")) returned 1 [0140.246] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8fuFu", cAlternateFileName="")) returned 1 [0140.246] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c49570, ftCreationTime.dwHighDateTime=0x1d825f7, ftLastAccessTime.dwLowDateTime=0xe3e47740, ftLastAccessTime.dwHighDateTime=0x1d829e5, ftLastWriteTime.dwLowDateTime=0xe3e47740, ftLastWriteTime.dwHighDateTime=0x1d829e5, nFileSizeHigh=0x0, nFileSizeLow=0x7069, dwReserved0=0x0, dwReserved1=0x0, cFileName="8H3cx4bVP1NLZr8fhYb.swf", cAlternateFileName="8H3CX4~1.SWF")) returned 1 [0140.247] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6165860, ftCreationTime.dwHighDateTime=0x1d81d21, ftLastAccessTime.dwLowDateTime=0x364c0e10, ftLastAccessTime.dwHighDateTime=0x1d8269b, ftLastWriteTime.dwLowDateTime=0x364c0e10, ftLastWriteTime.dwHighDateTime=0x1d8269b, nFileSizeHigh=0x0, nFileSizeLow=0xb505, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6CiMczxY2F3JXYRzK.png", cAlternateFileName="A6CIMC~1.PNG")) returned 1 [0140.247] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed61e80, ftCreationTime.dwHighDateTime=0x1d8280e, ftLastAccessTime.dwLowDateTime=0xb7188b20, ftLastAccessTime.dwHighDateTime=0x1d828aa, ftLastWriteTime.dwLowDateTime=0xb7188b20, ftLastWriteTime.dwHighDateTime=0x1d828aa, nFileSizeHigh=0x0, nFileSizeLow=0x18629, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9li7.bmp", cAlternateFileName="")) returned 1 [0140.247] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4b4370, ftCreationTime.dwHighDateTime=0x1d829e2, ftLastAccessTime.dwLowDateTime=0xe158e200, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0xe158e200, ftLastWriteTime.dwHighDateTime=0x1d829f3, nFileSizeHigh=0x0, nFileSizeLow=0xe6d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="aA9p.png", cAlternateFileName="")) returned 1 [0140.248] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e10200, ftCreationTime.dwHighDateTime=0x1d8589f, ftLastAccessTime.dwLowDateTime=0xc3799880, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0x227fe300, ftLastWriteTime.dwHighDateTime=0x1d85889, nFileSizeHigh=0x0, nFileSizeLow=0x39a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe", cAlternateFileName="BABA76~1.EXE")) returned 1 [0140.248] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd230, ftCreationTime.dwHighDateTime=0x1d81db1, ftLastAccessTime.dwLowDateTime=0xa0725a70, ftLastAccessTime.dwHighDateTime=0x1d825a5, ftLastWriteTime.dwLowDateTime=0xa0725a70, ftLastWriteTime.dwHighDateTime=0x1d825a5, nFileSizeHigh=0x0, nFileSizeLow=0x16eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7vniJGTZ.mp3", cAlternateFileName="C7VNIJ~1.MP3")) returned 1 [0140.248] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794ca3e0, ftCreationTime.dwHighDateTime=0x1d829a8, ftLastAccessTime.dwLowDateTime=0x1b90c270, ftLastAccessTime.dwHighDateTime=0x1d829b9, ftLastWriteTime.dwLowDateTime=0x1b90c270, ftLastWriteTime.dwHighDateTime=0x1d829b9, nFileSizeHigh=0x0, nFileSizeLow=0x12ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="CO1f.m4a", cAlternateFileName="")) returned 1 [0140.248] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0140.249] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b4a0080, ftCreationTime.dwHighDateTime=0x1d82261, ftLastAccessTime.dwLowDateTime=0x3dae6420, ftLastAccessTime.dwHighDateTime=0x1d8280b, ftLastWriteTime.dwLowDateTime=0x3dae6420, ftLastWriteTime.dwHighDateTime=0x1d8280b, nFileSizeHigh=0x0, nFileSizeLow=0x8ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dUAMxP2Q.m4a", cAlternateFileName="")) returned 1 [0140.249] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15588f60, ftCreationTime.dwHighDateTime=0x1d82526, ftLastAccessTime.dwLowDateTime=0x1fa82e70, ftLastAccessTime.dwHighDateTime=0x1d826a3, ftLastWriteTime.dwLowDateTime=0x1fa82e70, ftLastWriteTime.dwHighDateTime=0x1d826a3, nFileSizeHigh=0x0, nFileSizeLow=0x309f, dwReserved0=0x0, dwReserved1=0x0, cFileName="fch1HElCA7Cv3KXW.png", cAlternateFileName="FCH1HE~1.PNG")) returned 1 [0140.249] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d1f050, ftCreationTime.dwHighDateTime=0x1d82804, ftLastAccessTime.dwLowDateTime=0xb74dc940, ftLastAccessTime.dwHighDateTime=0x1d829d9, ftLastWriteTime.dwLowDateTime=0xb74dc940, ftLastWriteTime.dwHighDateTime=0x1d829d9, nFileSizeHigh=0x0, nFileSizeLow=0x4beb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GleaUaOZW Lth.avi", cAlternateFileName="GLEAUA~1.AVI")) returned 1 [0140.250] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6581ff0, ftCreationTime.dwHighDateTime=0x1d82648, ftLastAccessTime.dwLowDateTime=0xa4079e40, ftLastAccessTime.dwHighDateTime=0x1d8285a, ftLastWriteTime.dwLowDateTime=0xa4079e40, ftLastWriteTime.dwHighDateTime=0x1d8285a, nFileSizeHigh=0x0, nFileSizeLow=0x17903, dwReserved0=0x0, dwReserved1=0x0, cFileName="gPnVA1epmh.png", cAlternateFileName="GPNVA1~1.PNG")) returned 1 [0140.250] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f48d9a0, ftCreationTime.dwHighDateTime=0x1d8268b, ftLastAccessTime.dwLowDateTime=0xaa772510, ftLastAccessTime.dwHighDateTime=0x1d827f7, ftLastWriteTime.dwLowDateTime=0xaa772510, ftLastWriteTime.dwHighDateTime=0x1d827f7, nFileSizeHigh=0x0, nFileSizeLow=0xe419, dwReserved0=0x0, dwReserved1=0x0, cFileName="jKEImg2LCcB.png", cAlternateFileName="JKEIMG~1.PNG")) returned 1 [0140.250] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c171950, ftCreationTime.dwHighDateTime=0x1d81c87, ftLastAccessTime.dwLowDateTime=0xafb147c0, ftLastAccessTime.dwHighDateTime=0x1d826a5, ftLastWriteTime.dwLowDateTime=0xafb147c0, ftLastWriteTime.dwHighDateTime=0x1d826a5, nFileSizeHigh=0x0, nFileSizeLow=0x7869, dwReserved0=0x0, dwReserved1=0x0, cFileName="kFzsu2uze8.jpg", cAlternateFileName="KFZSU2~1.JPG")) returned 1 [0140.251] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460e43b0, ftCreationTime.dwHighDateTime=0x1d8228e, ftLastAccessTime.dwLowDateTime=0x76e4e150, ftLastAccessTime.dwHighDateTime=0x1d82a19, ftLastWriteTime.dwLowDateTime=0x76e4e150, ftLastWriteTime.dwHighDateTime=0x1d82a19, nFileSizeHigh=0x0, nFileSizeLow=0x8727, dwReserved0=0x0, dwReserved1=0x0, cFileName="km0vfS3iiuegbE.mp3", cAlternateFileName="KM0VFS~1.MP3")) returned 1 [0140.251] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddc3eb0, ftCreationTime.dwHighDateTime=0x1d82731, ftLastAccessTime.dwLowDateTime=0xf7465ec0, ftLastAccessTime.dwHighDateTime=0x1d827ce, ftLastWriteTime.dwLowDateTime=0xf7465ec0, ftLastWriteTime.dwHighDateTime=0x1d827ce, nFileSizeHigh=0x0, nFileSizeLow=0x13527, dwReserved0=0x0, dwReserved1=0x0, cFileName="lZ59hc.xls", cAlternateFileName="")) returned 1 [0140.251] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc235a10, ftCreationTime.dwHighDateTime=0x1d829c1, ftLastAccessTime.dwLowDateTime=0x4622c960, ftLastAccessTime.dwHighDateTime=0x1d82a1e, ftLastWriteTime.dwLowDateTime=0x4622c960, ftLastWriteTime.dwHighDateTime=0x1d82a1e, nFileSizeHigh=0x0, nFileSizeLow=0xacae, dwReserved0=0x0, dwReserved1=0x0, cFileName="nfhA716ggQO1lHuA.mp3", cAlternateFileName="NFHA71~1.MP3")) returned 1 [0140.251] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc94b9910, ftCreationTime.dwHighDateTime=0x1d824f2, ftLastAccessTime.dwLowDateTime=0xfa5db2b0, ftLastAccessTime.dwHighDateTime=0x1d82522, ftLastWriteTime.dwLowDateTime=0xfa5db2b0, ftLastWriteTime.dwHighDateTime=0x1d82522, nFileSizeHigh=0x0, nFileSizeLow=0x7f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="nI-Ynzgfo-bdwG.ods", cAlternateFileName="NI-YNZ~1.ODS")) returned 1 [0140.252] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359d5dc0, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0xb1b2c3e0, ftLastAccessTime.dwHighDateTime=0x1d828a4, ftLastWriteTime.dwLowDateTime=0xb1b2c3e0, ftLastWriteTime.dwHighDateTime=0x1d828a4, nFileSizeHigh=0x0, nFileSizeLow=0x45ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="NRNIxsblK328jZ.m4a", cAlternateFileName="NRNIXS~1.M4A")) returned 1 [0140.252] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda4aa0, ftCreationTime.dwHighDateTime=0x1d8246b, ftLastAccessTime.dwLowDateTime=0xada4e600, ftLastAccessTime.dwHighDateTime=0x1d82531, ftLastWriteTime.dwLowDateTime=0xada4e600, ftLastWriteTime.dwHighDateTime=0x1d82531, nFileSizeHigh=0x0, nFileSizeLow=0xc844, dwReserved0=0x0, dwReserved1=0x0, cFileName="qIiBDhQ7QB7UnHl2EQ1.gif", cAlternateFileName="QIIBDH~1.GIF")) returned 1 [0140.252] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20339d60, ftCreationTime.dwHighDateTime=0x1d81d12, ftLastAccessTime.dwLowDateTime=0x245234d0, ftLastAccessTime.dwHighDateTime=0x1d8276f, ftLastWriteTime.dwLowDateTime=0x245234d0, ftLastWriteTime.dwHighDateTime=0x1d8276f, nFileSizeHigh=0x0, nFileSizeLow=0x128b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="qxMCjsWp9C.swf", cAlternateFileName="QXMCJS~1.SWF")) returned 1 [0140.252] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8fb6f0, ftCreationTime.dwHighDateTime=0x1d827a5, ftLastAccessTime.dwLowDateTime=0x823cc880, ftLastAccessTime.dwHighDateTime=0x1d8283c, ftLastWriteTime.dwLowDateTime=0x823cc880, ftLastWriteTime.dwHighDateTime=0x1d8283c, nFileSizeHigh=0x0, nFileSizeLow=0x13019, dwReserved0=0x0, dwReserved1=0x0, cFileName="rfEzxhy.flv", cAlternateFileName="")) returned 1 [0140.253] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63efb400, ftCreationTime.dwHighDateTime=0x1d8206c, ftLastAccessTime.dwLowDateTime=0xf8c06ee0, ftLastAccessTime.dwHighDateTime=0x1d822dc, ftLastWriteTime.dwLowDateTime=0xf8c06ee0, ftLastWriteTime.dwHighDateTime=0x1d822dc, nFileSizeHigh=0x0, nFileSizeLow=0x1836c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S byA0FI2i1A.jpg", cAlternateFileName="SBYA0F~1.JPG")) returned 1 [0140.253] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc43afb0, ftCreationTime.dwHighDateTime=0x1d8210f, ftLastAccessTime.dwLowDateTime=0xdfa50190, ftLastAccessTime.dwHighDateTime=0x1d822ce, ftLastWriteTime.dwLowDateTime=0xdfa50190, ftLastWriteTime.dwHighDateTime=0x1d822ce, nFileSizeHigh=0x0, nFileSizeLow=0x1141e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWBY_7mpYkRP6I.avi", cAlternateFileName="TWBY_7~1.AVI")) returned 1 [0140.253] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b82ba0, ftCreationTime.dwHighDateTime=0x1d82888, ftLastAccessTime.dwLowDateTime=0x8e980cb0, ftLastAccessTime.dwHighDateTime=0x1d829d2, ftLastWriteTime.dwLowDateTime=0x8e980cb0, ftLastWriteTime.dwHighDateTime=0x1d829d2, nFileSizeHigh=0x0, nFileSizeLow=0x93e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UUZnNLpt1yyHK2REqD8.xls", cAlternateFileName="UUZNNL~1.XLS")) returned 1 [0140.253] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b642cf0, ftCreationTime.dwHighDateTime=0x1d8296c, ftLastAccessTime.dwLowDateTime=0xdab17dc0, ftLastAccessTime.dwHighDateTime=0x1d82a13, ftLastWriteTime.dwLowDateTime=0xdab17dc0, ftLastWriteTime.dwHighDateTime=0x1d82a13, nFileSizeHigh=0x0, nFileSizeLow=0x252c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WUHo.xls", cAlternateFileName="")) returned 1 [0140.254] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f94f300, ftCreationTime.dwHighDateTime=0x1d8226e, ftLastAccessTime.dwLowDateTime=0x3c69ff20, ftLastAccessTime.dwHighDateTime=0x1d8249b, ftLastWriteTime.dwLowDateTime=0x3c69ff20, ftLastWriteTime.dwHighDateTime=0x1d8249b, nFileSizeHigh=0x0, nFileSizeLow=0x40d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y9Yc7GFT5o-.flv", cAlternateFileName="Y9YC7G~1.FLV")) returned 1 [0140.254] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef413730, ftCreationTime.dwHighDateTime=0x1d81cd5, ftLastAccessTime.dwLowDateTime=0x4d5bae90, ftLastAccessTime.dwHighDateTime=0x1d81f92, ftLastWriteTime.dwLowDateTime=0x4d5bae90, ftLastWriteTime.dwHighDateTime=0x1d81f92, nFileSizeHigh=0x0, nFileSizeLow=0xa5e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yc_dgQq9.swf", cAlternateFileName="")) returned 1 [0140.254] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceefb870, ftCreationTime.dwHighDateTime=0x1d82893, ftLastAccessTime.dwLowDateTime=0xc13a12d0, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0xc13a12d0, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0x55d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZuEu4h9uDeB.mkv", cAlternateFileName="ZUEU4H~1.MKV")) returned 1 [0140.254] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb29820, ftCreationTime.dwHighDateTime=0x1d826f7, ftLastAccessTime.dwLowDateTime=0x800b3010, ftLastAccessTime.dwHighDateTime=0x1d8297c, ftLastWriteTime.dwLowDateTime=0x800b3010, ftLastWriteTime.dwHighDateTime=0x1d8297c, nFileSizeHigh=0x0, nFileSizeLow=0x177e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="_z9 qmOEfbbR2Ho.png", cAlternateFileName="_Z9QMO~1.PNG")) returned 1 [0140.255] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.255] FindClose (in: hFindFile=0x68fde0 | out: hFindFile=0x68fde0) returned 1 [0140.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1 [0140.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1 [0140.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1 [0140.256] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0140.256] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpFilePart=0x0) returned 0x1e [0140.256] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf18745d5, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0xf18745d5, ftLastWriteTime.dwHighDateTime=0x1d8589f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6900e0 [0140.257] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf18745d5, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0xf18745d5, ftLastWriteTime.dwHighDateTime=0x1d8589f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.258] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75469f50, ftCreationTime.dwHighDateTime=0x1d828d4, ftLastAccessTime.dwLowDateTime=0x70383f70, ftLastAccessTime.dwHighDateTime=0x1d82995, ftLastWriteTime.dwLowDateTime=0x70383f70, ftLastWriteTime.dwHighDateTime=0x1d82995, nFileSizeHigh=0x0, nFileSizeLow=0x723e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2BCq2zisH1tDLrOOSW.csv", cAlternateFileName="2BCQ2Z~1.CSV")) returned 1 [0140.263] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1027c60, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0xd8eca900, ftLastAccessTime.dwHighDateTime=0x1d82a23, ftLastWriteTime.dwLowDateTime=0xd8eca900, ftLastWriteTime.dwHighDateTime=0x1d82a23, nFileSizeHigh=0x0, nFileSizeLow=0x2103, dwReserved0=0x0, dwReserved1=0x0, cFileName="438nbzlkP EaX9m.flv", cAlternateFileName="438NBZ~1.FLV")) returned 1 [0140.264] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf64e39c0, ftCreationTime.dwHighDateTime=0x1d82576, ftLastAccessTime.dwLowDateTime=0x98e694d0, ftLastAccessTime.dwHighDateTime=0x1d827e2, ftLastWriteTime.dwLowDateTime=0x98e694d0, ftLastWriteTime.dwHighDateTime=0x1d827e2, nFileSizeHigh=0x0, nFileSizeLow=0x1697, dwReserved0=0x0, dwReserved1=0x0, cFileName="80TvEOvTr5nvyl.swf", cAlternateFileName="80TVEO~1.SWF")) returned 1 [0140.264] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109394f0, ftCreationTime.dwHighDateTime=0x1d82631, ftLastAccessTime.dwLowDateTime=0x42022320, ftLastAccessTime.dwHighDateTime=0x1d827e5, ftLastWriteTime.dwLowDateTime=0x42022320, ftLastWriteTime.dwHighDateTime=0x1d827e5, nFileSizeHigh=0x0, nFileSizeLow=0x14bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="87ZhhWQhavO-.mkv", cAlternateFileName="87ZHHW~1.MKV")) returned 1 [0140.264] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8fuFu", cAlternateFileName="")) returned 1 [0140.264] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c49570, ftCreationTime.dwHighDateTime=0x1d825f7, ftLastAccessTime.dwLowDateTime=0xe3e47740, ftLastAccessTime.dwHighDateTime=0x1d829e5, ftLastWriteTime.dwLowDateTime=0xe3e47740, ftLastWriteTime.dwHighDateTime=0x1d829e5, nFileSizeHigh=0x0, nFileSizeLow=0x7069, dwReserved0=0x0, dwReserved1=0x0, cFileName="8H3cx4bVP1NLZr8fhYb.swf", cAlternateFileName="8H3CX4~1.SWF")) returned 1 [0140.265] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6165860, ftCreationTime.dwHighDateTime=0x1d81d21, ftLastAccessTime.dwLowDateTime=0x364c0e10, ftLastAccessTime.dwHighDateTime=0x1d8269b, ftLastWriteTime.dwLowDateTime=0x364c0e10, ftLastWriteTime.dwHighDateTime=0x1d8269b, nFileSizeHigh=0x0, nFileSizeLow=0xb505, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6CiMczxY2F3JXYRzK.png", cAlternateFileName="A6CIMC~1.PNG")) returned 1 [0140.265] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed61e80, ftCreationTime.dwHighDateTime=0x1d8280e, ftLastAccessTime.dwLowDateTime=0xb7188b20, ftLastAccessTime.dwHighDateTime=0x1d828aa, ftLastWriteTime.dwLowDateTime=0xb7188b20, ftLastWriteTime.dwHighDateTime=0x1d828aa, nFileSizeHigh=0x0, nFileSizeLow=0x18629, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9li7.bmp", cAlternateFileName="")) returned 1 [0140.266] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4b4370, ftCreationTime.dwHighDateTime=0x1d829e2, ftLastAccessTime.dwLowDateTime=0xe158e200, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0xe158e200, ftLastWriteTime.dwHighDateTime=0x1d829f3, nFileSizeHigh=0x0, nFileSizeLow=0xe6d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="aA9p.png", cAlternateFileName="")) returned 1 [0140.266] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e10200, ftCreationTime.dwHighDateTime=0x1d8589f, ftLastAccessTime.dwLowDateTime=0xc3799880, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0x227fe300, ftLastWriteTime.dwHighDateTime=0x1d85889, nFileSizeHigh=0x0, nFileSizeLow=0x39a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe", cAlternateFileName="BABA76~1.EXE")) returned 1 [0140.266] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd230, ftCreationTime.dwHighDateTime=0x1d81db1, ftLastAccessTime.dwLowDateTime=0xa0725a70, ftLastAccessTime.dwHighDateTime=0x1d825a5, ftLastWriteTime.dwLowDateTime=0xa0725a70, ftLastWriteTime.dwHighDateTime=0x1d825a5, nFileSizeHigh=0x0, nFileSizeLow=0x16eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7vniJGTZ.mp3", cAlternateFileName="C7VNIJ~1.MP3")) returned 1 [0140.267] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794ca3e0, ftCreationTime.dwHighDateTime=0x1d829a8, ftLastAccessTime.dwLowDateTime=0x1b90c270, ftLastAccessTime.dwHighDateTime=0x1d829b9, ftLastWriteTime.dwLowDateTime=0x1b90c270, ftLastWriteTime.dwHighDateTime=0x1d829b9, nFileSizeHigh=0x0, nFileSizeLow=0x12ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="CO1f.m4a", cAlternateFileName="")) returned 1 [0140.267] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0140.267] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b4a0080, ftCreationTime.dwHighDateTime=0x1d82261, ftLastAccessTime.dwLowDateTime=0x3dae6420, ftLastAccessTime.dwHighDateTime=0x1d8280b, ftLastWriteTime.dwLowDateTime=0x3dae6420, ftLastWriteTime.dwHighDateTime=0x1d8280b, nFileSizeHigh=0x0, nFileSizeLow=0x8ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dUAMxP2Q.m4a", cAlternateFileName="")) returned 1 [0140.268] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15588f60, ftCreationTime.dwHighDateTime=0x1d82526, ftLastAccessTime.dwLowDateTime=0x1fa82e70, ftLastAccessTime.dwHighDateTime=0x1d826a3, ftLastWriteTime.dwLowDateTime=0x1fa82e70, ftLastWriteTime.dwHighDateTime=0x1d826a3, nFileSizeHigh=0x0, nFileSizeLow=0x309f, dwReserved0=0x0, dwReserved1=0x0, cFileName="fch1HElCA7Cv3KXW.png", cAlternateFileName="FCH1HE~1.PNG")) returned 1 [0140.268] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d1f050, ftCreationTime.dwHighDateTime=0x1d82804, ftLastAccessTime.dwLowDateTime=0xb74dc940, ftLastAccessTime.dwHighDateTime=0x1d829d9, ftLastWriteTime.dwLowDateTime=0xb74dc940, ftLastWriteTime.dwHighDateTime=0x1d829d9, nFileSizeHigh=0x0, nFileSizeLow=0x4beb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GleaUaOZW Lth.avi", cAlternateFileName="GLEAUA~1.AVI")) returned 1 [0140.269] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6581ff0, ftCreationTime.dwHighDateTime=0x1d82648, ftLastAccessTime.dwLowDateTime=0xa4079e40, ftLastAccessTime.dwHighDateTime=0x1d8285a, ftLastWriteTime.dwLowDateTime=0xa4079e40, ftLastWriteTime.dwHighDateTime=0x1d8285a, nFileSizeHigh=0x0, nFileSizeLow=0x17903, dwReserved0=0x0, dwReserved1=0x0, cFileName="gPnVA1epmh.png", cAlternateFileName="GPNVA1~1.PNG")) returned 1 [0140.269] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f48d9a0, ftCreationTime.dwHighDateTime=0x1d8268b, ftLastAccessTime.dwLowDateTime=0xaa772510, ftLastAccessTime.dwHighDateTime=0x1d827f7, ftLastWriteTime.dwLowDateTime=0xaa772510, ftLastWriteTime.dwHighDateTime=0x1d827f7, nFileSizeHigh=0x0, nFileSizeLow=0xe419, dwReserved0=0x0, dwReserved1=0x0, cFileName="jKEImg2LCcB.png", cAlternateFileName="JKEIMG~1.PNG")) returned 1 [0140.269] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c171950, ftCreationTime.dwHighDateTime=0x1d81c87, ftLastAccessTime.dwLowDateTime=0xafb147c0, ftLastAccessTime.dwHighDateTime=0x1d826a5, ftLastWriteTime.dwLowDateTime=0xafb147c0, ftLastWriteTime.dwHighDateTime=0x1d826a5, nFileSizeHigh=0x0, nFileSizeLow=0x7869, dwReserved0=0x0, dwReserved1=0x0, cFileName="kFzsu2uze8.jpg", cAlternateFileName="KFZSU2~1.JPG")) returned 1 [0140.270] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460e43b0, ftCreationTime.dwHighDateTime=0x1d8228e, ftLastAccessTime.dwLowDateTime=0x76e4e150, ftLastAccessTime.dwHighDateTime=0x1d82a19, ftLastWriteTime.dwLowDateTime=0x76e4e150, ftLastWriteTime.dwHighDateTime=0x1d82a19, nFileSizeHigh=0x0, nFileSizeLow=0x8727, dwReserved0=0x0, dwReserved1=0x0, cFileName="km0vfS3iiuegbE.mp3", cAlternateFileName="KM0VFS~1.MP3")) returned 1 [0140.270] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddc3eb0, ftCreationTime.dwHighDateTime=0x1d82731, ftLastAccessTime.dwLowDateTime=0xf7465ec0, ftLastAccessTime.dwHighDateTime=0x1d827ce, ftLastWriteTime.dwLowDateTime=0xf7465ec0, ftLastWriteTime.dwHighDateTime=0x1d827ce, nFileSizeHigh=0x0, nFileSizeLow=0x13527, dwReserved0=0x0, dwReserved1=0x0, cFileName="lZ59hc.xls", cAlternateFileName="")) returned 1 [0140.270] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc235a10, ftCreationTime.dwHighDateTime=0x1d829c1, ftLastAccessTime.dwLowDateTime=0x4622c960, ftLastAccessTime.dwHighDateTime=0x1d82a1e, ftLastWriteTime.dwLowDateTime=0x4622c960, ftLastWriteTime.dwHighDateTime=0x1d82a1e, nFileSizeHigh=0x0, nFileSizeLow=0xacae, dwReserved0=0x0, dwReserved1=0x0, cFileName="nfhA716ggQO1lHuA.mp3", cAlternateFileName="NFHA71~1.MP3")) returned 1 [0140.271] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc94b9910, ftCreationTime.dwHighDateTime=0x1d824f2, ftLastAccessTime.dwLowDateTime=0xfa5db2b0, ftLastAccessTime.dwHighDateTime=0x1d82522, ftLastWriteTime.dwLowDateTime=0xfa5db2b0, ftLastWriteTime.dwHighDateTime=0x1d82522, nFileSizeHigh=0x0, nFileSizeLow=0x7f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="nI-Ynzgfo-bdwG.ods", cAlternateFileName="NI-YNZ~1.ODS")) returned 1 [0140.271] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359d5dc0, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0xb1b2c3e0, ftLastAccessTime.dwHighDateTime=0x1d828a4, ftLastWriteTime.dwLowDateTime=0xb1b2c3e0, ftLastWriteTime.dwHighDateTime=0x1d828a4, nFileSizeHigh=0x0, nFileSizeLow=0x45ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="NRNIxsblK328jZ.m4a", cAlternateFileName="NRNIXS~1.M4A")) returned 1 [0140.271] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda4aa0, ftCreationTime.dwHighDateTime=0x1d8246b, ftLastAccessTime.dwLowDateTime=0xada4e600, ftLastAccessTime.dwHighDateTime=0x1d82531, ftLastWriteTime.dwLowDateTime=0xada4e600, ftLastWriteTime.dwHighDateTime=0x1d82531, nFileSizeHigh=0x0, nFileSizeLow=0xc844, dwReserved0=0x0, dwReserved1=0x0, cFileName="qIiBDhQ7QB7UnHl2EQ1.gif", cAlternateFileName="QIIBDH~1.GIF")) returned 1 [0140.272] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20339d60, ftCreationTime.dwHighDateTime=0x1d81d12, ftLastAccessTime.dwLowDateTime=0x245234d0, ftLastAccessTime.dwHighDateTime=0x1d8276f, ftLastWriteTime.dwLowDateTime=0x245234d0, ftLastWriteTime.dwHighDateTime=0x1d8276f, nFileSizeHigh=0x0, nFileSizeLow=0x128b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="qxMCjsWp9C.swf", cAlternateFileName="QXMCJS~1.SWF")) returned 1 [0140.273] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8fb6f0, ftCreationTime.dwHighDateTime=0x1d827a5, ftLastAccessTime.dwLowDateTime=0x823cc880, ftLastAccessTime.dwHighDateTime=0x1d8283c, ftLastWriteTime.dwLowDateTime=0x823cc880, ftLastWriteTime.dwHighDateTime=0x1d8283c, nFileSizeHigh=0x0, nFileSizeLow=0x13019, dwReserved0=0x0, dwReserved1=0x0, cFileName="rfEzxhy.flv", cAlternateFileName="")) returned 1 [0140.273] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63efb400, ftCreationTime.dwHighDateTime=0x1d8206c, ftLastAccessTime.dwLowDateTime=0xf8c06ee0, ftLastAccessTime.dwHighDateTime=0x1d822dc, ftLastWriteTime.dwLowDateTime=0xf8c06ee0, ftLastWriteTime.dwHighDateTime=0x1d822dc, nFileSizeHigh=0x0, nFileSizeLow=0x1836c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S byA0FI2i1A.jpg", cAlternateFileName="SBYA0F~1.JPG")) returned 1 [0140.273] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc43afb0, ftCreationTime.dwHighDateTime=0x1d8210f, ftLastAccessTime.dwLowDateTime=0xdfa50190, ftLastAccessTime.dwHighDateTime=0x1d822ce, ftLastWriteTime.dwLowDateTime=0xdfa50190, ftLastWriteTime.dwHighDateTime=0x1d822ce, nFileSizeHigh=0x0, nFileSizeLow=0x1141e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWBY_7mpYkRP6I.avi", cAlternateFileName="TWBY_7~1.AVI")) returned 1 [0140.274] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b82ba0, ftCreationTime.dwHighDateTime=0x1d82888, ftLastAccessTime.dwLowDateTime=0x8e980cb0, ftLastAccessTime.dwHighDateTime=0x1d829d2, ftLastWriteTime.dwLowDateTime=0x8e980cb0, ftLastWriteTime.dwHighDateTime=0x1d829d2, nFileSizeHigh=0x0, nFileSizeLow=0x93e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UUZnNLpt1yyHK2REqD8.xls", cAlternateFileName="UUZNNL~1.XLS")) returned 1 [0140.274] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b642cf0, ftCreationTime.dwHighDateTime=0x1d8296c, ftLastAccessTime.dwLowDateTime=0xdab17dc0, ftLastAccessTime.dwHighDateTime=0x1d82a13, ftLastWriteTime.dwLowDateTime=0xdab17dc0, ftLastWriteTime.dwHighDateTime=0x1d82a13, nFileSizeHigh=0x0, nFileSizeLow=0x252c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WUHo.xls", cAlternateFileName="")) returned 1 [0140.275] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f94f300, ftCreationTime.dwHighDateTime=0x1d8226e, ftLastAccessTime.dwLowDateTime=0x3c69ff20, ftLastAccessTime.dwHighDateTime=0x1d8249b, ftLastWriteTime.dwLowDateTime=0x3c69ff20, ftLastWriteTime.dwHighDateTime=0x1d8249b, nFileSizeHigh=0x0, nFileSizeLow=0x40d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y9Yc7GFT5o-.flv", cAlternateFileName="Y9YC7G~1.FLV")) returned 1 [0140.275] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef413730, ftCreationTime.dwHighDateTime=0x1d81cd5, ftLastAccessTime.dwLowDateTime=0x4d5bae90, ftLastAccessTime.dwHighDateTime=0x1d81f92, ftLastWriteTime.dwLowDateTime=0x4d5bae90, ftLastWriteTime.dwHighDateTime=0x1d81f92, nFileSizeHigh=0x0, nFileSizeLow=0xa5e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yc_dgQq9.swf", cAlternateFileName="")) returned 1 [0140.275] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceefb870, ftCreationTime.dwHighDateTime=0x1d82893, ftLastAccessTime.dwLowDateTime=0xc13a12d0, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0xc13a12d0, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0x55d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZuEu4h9uDeB.mkv", cAlternateFileName="ZUEU4H~1.MKV")) returned 1 [0140.276] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb29820, ftCreationTime.dwHighDateTime=0x1d826f7, ftLastAccessTime.dwLowDateTime=0x800b3010, ftLastAccessTime.dwHighDateTime=0x1d8297c, ftLastWriteTime.dwLowDateTime=0x800b3010, ftLastWriteTime.dwHighDateTime=0x1d8297c, nFileSizeHigh=0x0, nFileSizeLow=0x177e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="_z9 qmOEfbbR2Ho.png", cAlternateFileName="_Z9QMO~1.PNG")) returned 1 [0140.276] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb29820, ftCreationTime.dwHighDateTime=0x1d826f7, ftLastAccessTime.dwLowDateTime=0x800b3010, ftLastAccessTime.dwHighDateTime=0x1d8297c, ftLastWriteTime.dwLowDateTime=0x800b3010, ftLastWriteTime.dwHighDateTime=0x1d8297c, nFileSizeHigh=0x0, nFileSizeLow=0x177e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="_z9 qmOEfbbR2Ho.png", cAlternateFileName="_Z9QMO~1.PNG")) returned 0 [0140.276] FindClose (in: hFindFile=0x6900e0 | out: hFindFile=0x6900e0) returned 1 [0140.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1 [0140.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1 [0140.294] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", lpFilePart=0x0) returned 0x34 [0140.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0140.294] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2bcq2zish1tdlroosw.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4 [0140.295] GetFileType (hFile=0x2b4) returned 0x1 [0140.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0140.295] GetFileType (hFile=0x2b4) returned 0x1 [0140.297] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x723e [0140.298] ReadFile (in: hFile=0x2b4, lpBuffer=0x21e8d40, nNumberOfBytesToRead=0x723e, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x21e8d40*, lpNumberOfBytesRead=0x19eeb0*=0x723e, lpOverlapped=0x0) returned 1 [0140.300] CloseHandle (hObject=0x2b4) returned 1 [0146.723] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e8b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0146.724] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e91c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0146.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed7c) returned 1 [0146.724] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19edf8 | out: lpFileInformation=0x19edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0146.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed78) returned 1 [0147.381] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19eb0c | out: pfEnabled=0x19eb0c) returned 0x0 [0147.785] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", lpFilePart=0x0) returned 0x34 [0147.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0147.785] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2bcq2zish1tdlroosw.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0147.788] GetFileType (hFile=0x33c) returned 0x1 [0147.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0147.788] GetFileType (hFile=0x33c) returned 0x1 [0147.789] WriteFile (in: hFile=0x33c, lpBuffer=0x228386c*, nNumberOfBytesToWrite=0x7240, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x228386c*, lpNumberOfBytesWritten=0x19eea0*=0x7240, lpOverlapped=0x0) returned 1 [0147.791] CloseHandle (hObject=0x33c) returned 1 [0147.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", lpFilePart=0x0) returned 0x34 [0147.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv.coom", lpFilePart=0x0) returned 0x39 [0147.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0147.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2bcq2zish1tdlroosw.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75469f50, ftCreationTime.dwHighDateTime=0x1d828d4, ftLastAccessTime.dwLowDateTime=0x70383f70, ftLastAccessTime.dwHighDateTime=0x1d82995, ftLastWriteTime.dwLowDateTime=0x1cf043fd, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7240)) returned 1 [0147.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0147.795] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2bcq2zish1tdlroosw.csv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2bcq2zish1tdlroosw.csv.coom")) returned 1 [0147.796] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", lpFilePart=0x0) returned 0x31 [0147.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0147.796] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\438nbzlkp eax9m.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0147.796] GetFileType (hFile=0x33c) returned 0x1 [0147.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0147.796] GetFileType (hFile=0x33c) returned 0x1 [0147.797] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x2103 [0147.797] ReadFile (in: hFile=0x33c, lpBuffer=0x228ae58, nNumberOfBytesToRead=0x2103, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x228ae58*, lpNumberOfBytesRead=0x19eeb0*=0x2103, lpOverlapped=0x0) returned 1 [0147.798] CloseHandle (hObject=0x33c) returned 1 [0147.870] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", lpFilePart=0x0) returned 0x31 [0147.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0147.871] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\438nbzlkp eax9m.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0147.872] GetFileType (hFile=0x33c) returned 0x1 [0147.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0147.872] GetFileType (hFile=0x33c) returned 0x1 [0147.872] WriteFile (in: hFile=0x33c, lpBuffer=0x22e216c*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22e216c*, lpNumberOfBytesWritten=0x19eea0*=0x2110, lpOverlapped=0x0) returned 1 [0147.874] CloseHandle (hObject=0x33c) returned 1 [0147.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", lpFilePart=0x0) returned 0x31 [0147.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv.coom", lpFilePart=0x0) returned 0x36 [0147.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0147.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\438nbzlkp eax9m.flv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1027c60, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0xd8eca900, ftLastAccessTime.dwHighDateTime=0x1d82a23, ftLastWriteTime.dwLowDateTime=0x1cfcc46b, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x2110)) returned 1 [0147.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0147.876] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\438nbzlkp eax9m.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\438nbzlkp eax9m.flv.coom")) returned 1 [0147.877] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", lpFilePart=0x0) returned 0x30 [0147.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0147.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80tveovtr5nvyl.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0147.878] GetFileType (hFile=0x33c) returned 0x1 [0147.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0147.878] GetFileType (hFile=0x33c) returned 0x1 [0147.878] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1697 [0147.878] ReadFile (in: hFile=0x33c, lpBuffer=0x22e4608, nNumberOfBytesToRead=0x1697, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22e4608*, lpNumberOfBytesRead=0x19eeb0*=0x1697, lpOverlapped=0x0) returned 1 [0147.879] CloseHandle (hObject=0x33c) returned 1 [0147.926] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", lpFilePart=0x0) returned 0x30 [0147.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0147.926] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80tveovtr5nvyl.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0147.928] GetFileType (hFile=0x33c) returned 0x1 [0147.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0147.928] GetFileType (hFile=0x33c) returned 0x1 [0147.928] WriteFile (in: hFile=0x33c, lpBuffer=0x23384ec*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23384ec*, lpNumberOfBytesWritten=0x19eea0*=0x16a0, lpOverlapped=0x0) returned 1 [0147.930] CloseHandle (hObject=0x33c) returned 1 [0147.938] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", lpFilePart=0x0) returned 0x30 [0147.938] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf.coom", lpFilePart=0x0) returned 0x35 [0147.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0147.938] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80tveovtr5nvyl.swf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf64e39c0, ftCreationTime.dwHighDateTime=0x1d82576, ftLastAccessTime.dwLowDateTime=0x98e694d0, ftLastAccessTime.dwHighDateTime=0x1d827e2, ftLastWriteTime.dwLowDateTime=0x1d065444, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x16a0)) returned 1 [0147.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0147.939] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80tveovtr5nvyl.swf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80tveovtr5nvyl.swf.coom")) returned 1 [0147.940] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", lpFilePart=0x0) returned 0x35 [0147.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0147.940] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8h3cx4bvp1nlzr8fhyb.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0147.940] GetFileType (hFile=0x33c) returned 0x1 [0147.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0147.940] GetFileType (hFile=0x33c) returned 0x1 [0147.940] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x7069 [0147.941] ReadFile (in: hFile=0x33c, lpBuffer=0x2339f38, nNumberOfBytesToRead=0x7069, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2339f38*, lpNumberOfBytesRead=0x19eeb0*=0x7069, lpOverlapped=0x0) returned 1 [0147.942] CloseHandle (hObject=0x33c) returned 1 [0147.985] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", lpFilePart=0x0) returned 0x35 [0147.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0147.985] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8h3cx4bvp1nlzr8fhyb.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0147.986] GetFileType (hFile=0x33c) returned 0x1 [0147.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0147.987] GetFileType (hFile=0x33c) returned 0x1 [0147.987] WriteFile (in: hFile=0x33c, lpBuffer=0x23a9f2c*, nNumberOfBytesToWrite=0x7070, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23a9f2c*, lpNumberOfBytesWritten=0x19eea0*=0x7070, lpOverlapped=0x0) returned 1 [0147.989] CloseHandle (hObject=0x33c) returned 1 [0147.992] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", lpFilePart=0x0) returned 0x35 [0147.992] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf.coom", lpFilePart=0x0) returned 0x3a [0147.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0147.993] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8h3cx4bvp1nlzr8fhyb.swf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c49570, ftCreationTime.dwHighDateTime=0x1d825f7, ftLastAccessTime.dwLowDateTime=0xe3e47740, ftLastAccessTime.dwHighDateTime=0x1d829e5, ftLastWriteTime.dwLowDateTime=0x1d0e9a4f, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7070)) returned 1 [0147.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0147.993] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8h3cx4bvp1nlzr8fhyb.swf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8h3cx4bvp1nlzr8fhyb.swf.coom")) returned 1 [0147.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", lpFilePart=0x0) returned 0x34 [0147.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0147.994] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a6cimczxy2f3jxyrzk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0147.995] GetFileType (hFile=0x33c) returned 0x1 [0147.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0147.995] GetFileType (hFile=0x33c) returned 0x1 [0147.995] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xb505 [0147.997] ReadFile (in: hFile=0x33c, lpBuffer=0x23b1360, nNumberOfBytesToRead=0xb505, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23b1360*, lpNumberOfBytesRead=0x19eeb0*=0xb505, lpOverlapped=0x0) returned 1 [0147.999] CloseHandle (hObject=0x33c) returned 1 [0148.128] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", lpFilePart=0x0) returned 0x34 [0148.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.128] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a6cimczxy2f3jxyrzk.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.130] GetFileType (hFile=0x33c) returned 0x1 [0148.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.130] GetFileType (hFile=0x33c) returned 0x1 [0148.130] WriteFile (in: hFile=0x33c, lpBuffer=0x22434a4*, nNumberOfBytesToWrite=0xb510, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22434a4*, lpNumberOfBytesWritten=0x19eea0*=0xb510, lpOverlapped=0x0) returned 1 [0148.132] CloseHandle (hObject=0x33c) returned 1 [0148.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", lpFilePart=0x0) returned 0x34 [0148.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png.coom", lpFilePart=0x0) returned 0x39 [0148.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.134] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a6cimczxy2f3jxyrzk.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6165860, ftCreationTime.dwHighDateTime=0x1d81d21, ftLastAccessTime.dwLowDateTime=0x364c0e10, ftLastAccessTime.dwHighDateTime=0x1d8269b, ftLastWriteTime.dwLowDateTime=0x1d244778, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xb510)) returned 1 [0148.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.135] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a6cimczxy2f3jxyrzk.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a6cimczxy2f3jxyrzk.png.coom")) returned 1 [0148.135] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", lpFilePart=0x0) returned 0x27 [0148.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.136] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a9li7.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.136] GetFileType (hFile=0x33c) returned 0x1 [0148.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.136] GetFileType (hFile=0x33c) returned 0x1 [0148.136] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x18629 [0148.138] ReadFile (in: hFile=0x33c, lpBuffer=0x31f8870, nNumberOfBytesToRead=0x18629, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x31f8870*, lpNumberOfBytesRead=0x19eeb0*=0x18629, lpOverlapped=0x0) returned 1 [0148.140] CloseHandle (hObject=0x33c) returned 1 [0148.167] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", lpFilePart=0x0) returned 0x27 [0148.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.168] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a9li7.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.170] GetFileType (hFile=0x33c) returned 0x1 [0148.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.170] GetFileType (hFile=0x33c) returned 0x1 [0148.170] WriteFile (in: hFile=0x33c, lpBuffer=0x3272798*, nNumberOfBytesToWrite=0x18630, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3272798*, lpNumberOfBytesWritten=0x19eea0*=0x18630, lpOverlapped=0x0) returned 1 [0148.175] CloseHandle (hObject=0x33c) returned 1 [0148.178] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", lpFilePart=0x0) returned 0x27 [0148.178] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp.coom", lpFilePart=0x0) returned 0x2c [0148.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a9li7.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed61e80, ftCreationTime.dwHighDateTime=0x1d8280e, ftLastAccessTime.dwLowDateTime=0xb7188b20, ftLastAccessTime.dwHighDateTime=0x1d828aa, ftLastWriteTime.dwLowDateTime=0x1d2b00af, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x18630)) returned 1 [0148.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.179] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a9li7.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a9li7.bmp.coom")) returned 1 [0148.180] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", lpFilePart=0x0) returned 0x26 [0148.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.180] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aa9p.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.180] GetFileType (hFile=0x33c) returned 0x1 [0148.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.180] GetFileType (hFile=0x33c) returned 0x1 [0148.180] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xe6d6 [0148.180] ReadFile (in: hFile=0x33c, lpBuffer=0x229bf60, nNumberOfBytesToRead=0xe6d6, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x229bf60*, lpNumberOfBytesRead=0x19eeb0*=0xe6d6, lpOverlapped=0x0) returned 1 [0148.182] CloseHandle (hObject=0x33c) returned 1 [0148.241] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", lpFilePart=0x0) returned 0x26 [0148.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.241] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aa9p.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.243] GetFileType (hFile=0x33c) returned 0x1 [0148.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.243] GetFileType (hFile=0x33c) returned 0x1 [0148.243] WriteFile (in: hFile=0x33c, lpBuffer=0x23141d8*, nNumberOfBytesToWrite=0xe6e0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23141d8*, lpNumberOfBytesWritten=0x19eea0*=0xe6e0, lpOverlapped=0x0) returned 1 [0148.245] CloseHandle (hObject=0x33c) returned 1 [0148.250] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", lpFilePart=0x0) returned 0x26 [0148.250] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png.coom", lpFilePart=0x0) returned 0x2b [0148.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aa9p.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4b4370, ftCreationTime.dwHighDateTime=0x1d829e2, ftLastAccessTime.dwLowDateTime=0xe158e200, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0x1d35f27e, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xe6e0)) returned 1 [0148.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.251] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aa9p.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aa9p.png.coom")) returned 1 [0148.251] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", lpFilePart=0x0) returned 0x32 [0148.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.251] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\fch1helca7cv3kxw.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.251] GetFileType (hFile=0x33c) returned 0x1 [0148.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.252] GetFileType (hFile=0x33c) returned 0x1 [0148.252] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x309f [0148.252] ReadFile (in: hFile=0x33c, lpBuffer=0x2322c58, nNumberOfBytesToRead=0x309f, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2322c58*, lpNumberOfBytesRead=0x19eeb0*=0x309f, lpOverlapped=0x0) returned 1 [0148.253] CloseHandle (hObject=0x33c) returned 1 [0148.271] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", lpFilePart=0x0) returned 0x32 [0148.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.271] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\fch1helca7cv3kxw.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.272] GetFileType (hFile=0x33c) returned 0x1 [0148.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.272] GetFileType (hFile=0x33c) returned 0x1 [0148.272] WriteFile (in: hFile=0x33c, lpBuffer=0x237ed3c*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x237ed3c*, lpNumberOfBytesWritten=0x19eea0*=0x30a0, lpOverlapped=0x0) returned 1 [0148.284] CloseHandle (hObject=0x33c) returned 1 [0148.286] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", lpFilePart=0x0) returned 0x32 [0148.286] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png.coom", lpFilePart=0x0) returned 0x37 [0148.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.286] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\fch1helca7cv3kxw.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15588f60, ftCreationTime.dwHighDateTime=0x1d82526, ftLastAccessTime.dwLowDateTime=0x1fa82e70, ftLastAccessTime.dwHighDateTime=0x1d826a3, ftLastWriteTime.dwLowDateTime=0x1d3b5b06, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x30a0)) returned 1 [0148.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.286] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\fch1helca7cv3kxw.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\fch1helca7cv3kxw.png.coom")) returned 1 [0148.287] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", lpFilePart=0x0) returned 0x2c [0148.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.287] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gpnva1epmh.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.287] GetFileType (hFile=0x33c) returned 0x1 [0148.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.287] GetFileType (hFile=0x33c) returned 0x1 [0148.287] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x17903 [0148.288] ReadFile (in: hFile=0x33c, lpBuffer=0x32a7ba8, nNumberOfBytesToRead=0x17903, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x32a7ba8*, lpNumberOfBytesRead=0x19eeb0*=0x17903, lpOverlapped=0x0) returned 1 [0148.314] CloseHandle (hObject=0x33c) returned 1 [0148.358] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", lpFilePart=0x0) returned 0x2c [0148.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.358] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gpnva1epmh.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.360] GetFileType (hFile=0x33c) returned 0x1 [0148.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.360] GetFileType (hFile=0x33c) returned 0x1 [0148.360] WriteFile (in: hFile=0x33c, lpBuffer=0x331d928*, nNumberOfBytesToWrite=0x17910, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x331d928*, lpNumberOfBytesWritten=0x19eea0*=0x17910, lpOverlapped=0x0) returned 1 [0148.363] CloseHandle (hObject=0x33c) returned 1 [0148.367] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", lpFilePart=0x0) returned 0x2c [0148.367] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png.coom", lpFilePart=0x0) returned 0x31 [0148.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.367] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gpnva1epmh.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6581ff0, ftCreationTime.dwHighDateTime=0x1d82648, ftLastAccessTime.dwLowDateTime=0xa4079e40, ftLastAccessTime.dwHighDateTime=0x1d8285a, ftLastWriteTime.dwLowDateTime=0x1d47b683, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17910)) returned 1 [0148.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.367] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gpnva1epmh.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gpnva1epmh.png.coom")) returned 1 [0148.368] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", lpFilePart=0x0) returned 0x2d [0148.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.368] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jkeimg2lccb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.368] GetFileType (hFile=0x33c) returned 0x1 [0148.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.368] GetFileType (hFile=0x33c) returned 0x1 [0148.368] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xe419 [0148.370] ReadFile (in: hFile=0x33c, lpBuffer=0x23cf29c, nNumberOfBytesToRead=0xe419, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23cf29c*, lpNumberOfBytesRead=0x19eeb0*=0xe419, lpOverlapped=0x0) returned 1 [0148.371] CloseHandle (hObject=0x33c) returned 1 [0148.450] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", lpFilePart=0x0) returned 0x2d [0148.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.450] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jkeimg2lccb.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.452] GetFileType (hFile=0x33c) returned 0x1 [0148.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.452] GetFileType (hFile=0x33c) returned 0x1 [0148.452] WriteFile (in: hFile=0x33c, lpBuffer=0x2446cd4*, nNumberOfBytesToWrite=0xe420, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2446cd4*, lpNumberOfBytesWritten=0x19eea0*=0xe420, lpOverlapped=0x0) returned 1 [0148.455] CloseHandle (hObject=0x33c) returned 1 [0148.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", lpFilePart=0x0) returned 0x2d [0148.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png.coom", lpFilePart=0x0) returned 0x32 [0148.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jkeimg2lccb.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f48d9a0, ftCreationTime.dwHighDateTime=0x1d8268b, ftLastAccessTime.dwLowDateTime=0xaa772510, ftLastAccessTime.dwHighDateTime=0x1d827f7, ftLastWriteTime.dwLowDateTime=0x1d5593ed, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xe420)) returned 1 [0148.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.458] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jkeimg2lccb.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jkeimg2lccb.png.coom")) returned 1 [0148.458] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", lpFilePart=0x0) returned 0x2c [0148.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.459] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\kfzsu2uze8.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.459] GetFileType (hFile=0x33c) returned 0x1 [0148.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.459] GetFileType (hFile=0x33c) returned 0x1 [0148.459] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x7869 [0148.460] ReadFile (in: hFile=0x33c, lpBuffer=0x2455448, nNumberOfBytesToRead=0x7869, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2455448*, lpNumberOfBytesRead=0x19eeb0*=0x7869, lpOverlapped=0x0) returned 1 [0148.461] CloseHandle (hObject=0x33c) returned 1 [0148.532] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", lpFilePart=0x0) returned 0x2c [0148.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.532] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\kfzsu2uze8.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.534] GetFileType (hFile=0x33c) returned 0x1 [0148.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.534] GetFileType (hFile=0x33c) returned 0x1 [0148.534] WriteFile (in: hFile=0x33c, lpBuffer=0x2214084*, nNumberOfBytesToWrite=0x7870, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2214084*, lpNumberOfBytesWritten=0x19eea0*=0x7870, lpOverlapped=0x0) returned 1 [0148.535] CloseHandle (hObject=0x33c) returned 1 [0148.541] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", lpFilePart=0x0) returned 0x2c [0148.541] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg.coom", lpFilePart=0x0) returned 0x31 [0148.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\kfzsu2uze8.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c171950, ftCreationTime.dwHighDateTime=0x1d81c87, ftLastAccessTime.dwLowDateTime=0xafb147c0, ftLastAccessTime.dwHighDateTime=0x1d826a5, ftLastWriteTime.dwLowDateTime=0x1d626b74, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7870)) returned 1 [0148.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.542] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\kfzsu2uze8.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\kfzsu2uze8.jpg.coom")) returned 1 [0148.542] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", lpFilePart=0x0) returned 0x28 [0148.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.543] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lz59hc.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.543] GetFileType (hFile=0x33c) returned 0x1 [0148.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.543] GetFileType (hFile=0x33c) returned 0x1 [0148.543] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x13527 [0148.543] ReadFile (in: hFile=0x33c, lpBuffer=0x221bc48, nNumberOfBytesToRead=0x13527, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x221bc48*, lpNumberOfBytesRead=0x19eeb0*=0x13527, lpOverlapped=0x0) returned 1 [0148.545] CloseHandle (hObject=0x33c) returned 1 [0148.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", lpFilePart=0x0) returned 0x28 [0148.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.570] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lz59hc.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.572] GetFileType (hFile=0x33c) returned 0x1 [0148.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.572] GetFileType (hFile=0x33c) returned 0x1 [0148.572] WriteFile (in: hFile=0x33c, lpBuffer=0x22a2b0c*, nNumberOfBytesToWrite=0x13530, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22a2b0c*, lpNumberOfBytesWritten=0x19eea0*=0x13530, lpOverlapped=0x0) returned 1 [0148.575] CloseHandle (hObject=0x33c) returned 1 [0148.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", lpFilePart=0x0) returned 0x28 [0148.578] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls.coom", lpFilePart=0x0) returned 0x2d [0148.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lz59hc.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddc3eb0, ftCreationTime.dwHighDateTime=0x1d82731, ftLastAccessTime.dwLowDateTime=0xf7465ec0, ftLastAccessTime.dwHighDateTime=0x1d827ce, ftLastWriteTime.dwLowDateTime=0x1d67edd3, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13530)) returned 1 [0148.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.578] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lz59hc.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lz59hc.xls.coom")) returned 1 [0148.579] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", lpFilePart=0x0) returned 0x30 [0148.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.579] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ni-ynzgfo-bdwg.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.579] GetFileType (hFile=0x33c) returned 0x1 [0148.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.579] GetFileType (hFile=0x33c) returned 0x1 [0148.579] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x7f4d [0148.579] ReadFile (in: hFile=0x33c, lpBuffer=0x22b6388, nNumberOfBytesToRead=0x7f4d, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22b6388*, lpNumberOfBytesRead=0x19eeb0*=0x7f4d, lpOverlapped=0x0) returned 1 [0148.581] CloseHandle (hObject=0x33c) returned 1 [0148.600] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", lpFilePart=0x0) returned 0x30 [0148.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.600] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ni-ynzgfo-bdwg.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.605] GetFileType (hFile=0x33c) returned 0x1 [0148.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.605] GetFileType (hFile=0x33c) returned 0x1 [0148.605] WriteFile (in: hFile=0x33c, lpBuffer=0x232addc*, nNumberOfBytesToWrite=0x7f50, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x232addc*, lpNumberOfBytesWritten=0x19eea0*=0x7f50, lpOverlapped=0x0) returned 1 [0148.606] CloseHandle (hObject=0x33c) returned 1 [0148.608] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", lpFilePart=0x0) returned 0x30 [0148.608] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods.coom", lpFilePart=0x0) returned 0x35 [0148.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ni-ynzgfo-bdwg.ods"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc94b9910, ftCreationTime.dwHighDateTime=0x1d824f2, ftLastAccessTime.dwLowDateTime=0xfa5db2b0, ftLastAccessTime.dwHighDateTime=0x1d82522, ftLastWriteTime.dwLowDateTime=0x1d6c9f12, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7f50)) returned 1 [0148.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.609] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ni-ynzgfo-bdwg.ods"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ni-ynzgfo-bdwg.ods.coom")) returned 1 [0148.610] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", lpFilePart=0x0) returned 0x2c [0148.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.610] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qxmcjswp9c.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.610] GetFileType (hFile=0x33c) returned 0x1 [0148.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.610] GetFileType (hFile=0x33c) returned 0x1 [0148.610] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x128b6 [0148.610] ReadFile (in: hFile=0x33c, lpBuffer=0x23330d0, nNumberOfBytesToRead=0x128b6, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23330d0*, lpNumberOfBytesRead=0x19eeb0*=0x128b6, lpOverlapped=0x0) returned 1 [0148.612] CloseHandle (hObject=0x33c) returned 1 [0148.639] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", lpFilePart=0x0) returned 0x2c [0148.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.639] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qxmcjswp9c.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.641] GetFileType (hFile=0x33c) returned 0x1 [0148.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.641] GetFileType (hFile=0x33c) returned 0x1 [0148.641] WriteFile (in: hFile=0x33c, lpBuffer=0x23b78e8*, nNumberOfBytesToWrite=0x128c0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23b78e8*, lpNumberOfBytesWritten=0x19eea0*=0x128c0, lpOverlapped=0x0) returned 1 [0148.644] CloseHandle (hObject=0x33c) returned 1 [0148.647] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", lpFilePart=0x0) returned 0x2c [0148.647] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf.coom", lpFilePart=0x0) returned 0x31 [0148.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qxmcjswp9c.swf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20339d60, ftCreationTime.dwHighDateTime=0x1d81d12, ftLastAccessTime.dwLowDateTime=0x245234d0, ftLastAccessTime.dwHighDateTime=0x1d8276f, ftLastWriteTime.dwLowDateTime=0x1d727e3c, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x128c0)) returned 1 [0148.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.647] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qxmcjswp9c.swf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qxmcjswp9c.swf.coom")) returned 1 [0148.648] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", lpFilePart=0x0) returned 0x29 [0148.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.648] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\rfezxhy.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.648] GetFileType (hFile=0x33c) returned 0x1 [0148.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.648] GetFileType (hFile=0x33c) returned 0x1 [0148.648] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x13019 [0148.648] ReadFile (in: hFile=0x33c, lpBuffer=0x23ca4e4, nNumberOfBytesToRead=0x13019, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23ca4e4*, lpNumberOfBytesRead=0x19eeb0*=0x13019, lpOverlapped=0x0) returned 1 [0148.650] CloseHandle (hObject=0x33c) returned 1 [0148.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", lpFilePart=0x0) returned 0x29 [0148.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.723] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\rfezxhy.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.725] GetFileType (hFile=0x33c) returned 0x1 [0148.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.725] GetFileType (hFile=0x33c) returned 0x1 [0148.725] WriteFile (in: hFile=0x33c, lpBuffer=0x224ff18*, nNumberOfBytesToWrite=0x13020, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x224ff18*, lpNumberOfBytesWritten=0x19eea0*=0x13020, lpOverlapped=0x0) returned 1 [0148.728] CloseHandle (hObject=0x33c) returned 1 [0148.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", lpFilePart=0x0) returned 0x29 [0148.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv.coom", lpFilePart=0x0) returned 0x2e [0148.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\rfezxhy.flv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8fb6f0, ftCreationTime.dwHighDateTime=0x1d827a5, ftLastAccessTime.dwLowDateTime=0x823cc880, ftLastAccessTime.dwHighDateTime=0x1d8283c, ftLastWriteTime.dwLowDateTime=0x1d7f4785, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13020)) returned 1 [0148.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.731] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\rfezxhy.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\rfezxhy.flv.coom")) returned 1 [0148.732] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", lpFilePart=0x0) returned 0x2e [0148.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.732] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s bya0fi2i1a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.732] GetFileType (hFile=0x33c) returned 0x1 [0148.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.732] GetFileType (hFile=0x33c) returned 0x1 [0148.732] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1836c [0148.733] ReadFile (in: hFile=0x33c, lpBuffer=0x33c36b8, nNumberOfBytesToRead=0x1836c, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x33c36b8*, lpNumberOfBytesRead=0x19eeb0*=0x1836c, lpOverlapped=0x0) returned 1 [0148.737] CloseHandle (hObject=0x33c) returned 1 [0148.769] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", lpFilePart=0x0) returned 0x2e [0148.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.769] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s bya0fi2i1a.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.771] GetFileType (hFile=0x33c) returned 0x1 [0148.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.771] GetFileType (hFile=0x33c) returned 0x1 [0148.771] WriteFile (in: hFile=0x33c, lpBuffer=0x343c820*, nNumberOfBytesToWrite=0x18370, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x343c820*, lpNumberOfBytesWritten=0x19eea0*=0x18370, lpOverlapped=0x0) returned 1 [0148.774] CloseHandle (hObject=0x33c) returned 1 [0148.780] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", lpFilePart=0x0) returned 0x2e [0148.780] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg.coom", lpFilePart=0x0) returned 0x33 [0148.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s bya0fi2i1a.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63efb400, ftCreationTime.dwHighDateTime=0x1d8206c, ftLastAccessTime.dwLowDateTime=0xf8c06ee0, ftLastAccessTime.dwHighDateTime=0x1d822dc, ftLastWriteTime.dwLowDateTime=0x1d86c806, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x18370)) returned 1 [0148.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.780] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s bya0fi2i1a.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s bya0fi2i1a.jpg.coom")) returned 1 [0148.781] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", lpFilePart=0x0) returned 0x35 [0148.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.781] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\uuznnlpt1yyhk2reqd8.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.781] GetFileType (hFile=0x33c) returned 0x1 [0148.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.782] GetFileType (hFile=0x33c) returned 0x1 [0148.782] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x93e4 [0148.782] ReadFile (in: hFile=0x33c, lpBuffer=0x22b0528, nNumberOfBytesToRead=0x93e4, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22b0528*, lpNumberOfBytesRead=0x19eeb0*=0x93e4, lpOverlapped=0x0) returned 1 [0148.783] CloseHandle (hObject=0x33c) returned 1 [0148.864] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", lpFilePart=0x0) returned 0x35 [0148.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.868] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\uuznnlpt1yyhk2reqd8.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.870] GetFileType (hFile=0x33c) returned 0x1 [0148.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.870] GetFileType (hFile=0x33c) returned 0x1 [0148.870] WriteFile (in: hFile=0x33c, lpBuffer=0x232b698*, nNumberOfBytesToWrite=0x93f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x232b698*, lpNumberOfBytesWritten=0x19eea0*=0x93f0, lpOverlapped=0x0) returned 1 [0148.873] CloseHandle (hObject=0x33c) returned 1 [0148.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", lpFilePart=0x0) returned 0x35 [0148.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls.coom", lpFilePart=0x0) returned 0x3a [0148.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\uuznnlpt1yyhk2reqd8.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b82ba0, ftCreationTime.dwHighDateTime=0x1d82888, ftLastAccessTime.dwLowDateTime=0x8e980cb0, ftLastAccessTime.dwHighDateTime=0x1d829d2, ftLastWriteTime.dwLowDateTime=0x1d9562ce, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x93f0)) returned 1 [0148.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.876] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\uuznnlpt1yyhk2reqd8.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\uuznnlpt1yyhk2reqd8.xls.coom")) returned 1 [0148.877] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", lpFilePart=0x0) returned 0x26 [0148.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wuho.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.877] GetFileType (hFile=0x33c) returned 0x1 [0148.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.877] GetFileType (hFile=0x33c) returned 0x1 [0148.877] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x252c [0148.878] ReadFile (in: hFile=0x33c, lpBuffer=0x2334e14, nNumberOfBytesToRead=0x252c, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2334e14*, lpNumberOfBytesRead=0x19eeb0*=0x252c, lpOverlapped=0x0) returned 1 [0148.879] CloseHandle (hObject=0x33c) returned 1 [0148.899] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", lpFilePart=0x0) returned 0x26 [0148.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.900] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wuho.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.901] GetFileType (hFile=0x33c) returned 0x1 [0148.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.901] GetFileType (hFile=0x33c) returned 0x1 [0148.901] WriteFile (in: hFile=0x33c, lpBuffer=0x238d5c4*, nNumberOfBytesToWrite=0x2530, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x238d5c4*, lpNumberOfBytesWritten=0x19eea0*=0x2530, lpOverlapped=0x0) returned 1 [0148.903] CloseHandle (hObject=0x33c) returned 1 [0148.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", lpFilePart=0x0) returned 0x26 [0148.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls.coom", lpFilePart=0x0) returned 0x2b [0148.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wuho.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b642cf0, ftCreationTime.dwHighDateTime=0x1d8296c, ftLastAccessTime.dwLowDateTime=0xdab17dc0, ftLastAccessTime.dwHighDateTime=0x1d82a13, ftLastWriteTime.dwLowDateTime=0x1d99bb98, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x2530)) returned 1 [0148.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.904] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wuho.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wuho.xls.coom")) returned 1 [0148.905] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", lpFilePart=0x0) returned 0x2d [0148.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.905] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y9yc7gft5o-.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.905] GetFileType (hFile=0x33c) returned 0x1 [0148.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.906] GetFileType (hFile=0x33c) returned 0x1 [0148.906] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x40d9 [0148.906] ReadFile (in: hFile=0x33c, lpBuffer=0x238fe04, nNumberOfBytesToRead=0x40d9, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x238fe04*, lpNumberOfBytesRead=0x19eeb0*=0x40d9, lpOverlapped=0x0) returned 1 [0148.907] CloseHandle (hObject=0x33c) returned 1 [0148.945] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", lpFilePart=0x0) returned 0x2d [0148.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0148.945] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y9yc7gft5o-.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.947] GetFileType (hFile=0x33c) returned 0x1 [0148.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0148.947] GetFileType (hFile=0x33c) returned 0x1 [0148.947] WriteFile (in: hFile=0x33c, lpBuffer=0x21f40e8*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x21f40e8*, lpNumberOfBytesWritten=0x19eea0*=0x40e0, lpOverlapped=0x0) returned 1 [0148.950] CloseHandle (hObject=0x33c) returned 1 [0148.952] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", lpFilePart=0x0) returned 0x2d [0148.952] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv.coom", lpFilePart=0x0) returned 0x32 [0148.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0148.952] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y9yc7gft5o-.flv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f94f300, ftCreationTime.dwHighDateTime=0x1d8226e, ftLastAccessTime.dwLowDateTime=0x3c69ff20, ftLastAccessTime.dwHighDateTime=0x1d8249b, ftLastWriteTime.dwLowDateTime=0x1da10b7f, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x40e0)) returned 1 [0148.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0148.953] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y9yc7gft5o-.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y9yc7gft5o-.flv.coom")) returned 1 [0148.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", lpFilePart=0x0) returned 0x2a [0148.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0148.954] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yc_dgqq9.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0148.954] GetFileType (hFile=0x33c) returned 0x1 [0148.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0148.954] GetFileType (hFile=0x33c) returned 0x1 [0148.954] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xa5e1 [0148.954] ReadFile (in: hFile=0x33c, lpBuffer=0x21f8514, nNumberOfBytesToRead=0xa5e1, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x21f8514*, lpNumberOfBytesRead=0x19eeb0*=0xa5e1, lpOverlapped=0x0) returned 1 [0148.956] CloseHandle (hObject=0x33c) returned 1 [0149.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", lpFilePart=0x0) returned 0x2a [0149.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0149.015] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yc_dgqq9.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.017] GetFileType (hFile=0x33c) returned 0x1 [0149.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0149.017] GetFileType (hFile=0x33c) returned 0x1 [0149.017] WriteFile (in: hFile=0x33c, lpBuffer=0x22791e4*, nNumberOfBytesToWrite=0xa5f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22791e4*, lpNumberOfBytesWritten=0x19eea0*=0xa5f0, lpOverlapped=0x0) returned 1 [0149.022] CloseHandle (hObject=0x33c) returned 1 [0149.025] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", lpFilePart=0x0) returned 0x2a [0149.025] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf.coom", lpFilePart=0x0) returned 0x2f [0149.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0149.025] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yc_dgqq9.swf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef413730, ftCreationTime.dwHighDateTime=0x1d81cd5, ftLastAccessTime.dwLowDateTime=0x4d5bae90, ftLastAccessTime.dwHighDateTime=0x1d81f92, ftLastWriteTime.dwLowDateTime=0x1dac0bf2, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xa5f0)) returned 1 [0149.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0149.025] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yc_dgqq9.swf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yc_dgqq9.swf.coom")) returned 1 [0149.027] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", lpFilePart=0x0) returned 0x31 [0149.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0149.027] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\_z9 qmoefbbr2ho.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.028] GetFileType (hFile=0x33c) returned 0x1 [0149.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0149.028] GetFileType (hFile=0x33c) returned 0x1 [0149.028] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x177e4 [0149.029] ReadFile (in: hFile=0x33c, lpBuffer=0x3454bb0, nNumberOfBytesToRead=0x177e4, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3454bb0*, lpNumberOfBytesRead=0x19eeb0*=0x177e4, lpOverlapped=0x0) returned 1 [0149.035] CloseHandle (hObject=0x33c) returned 1 [0149.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", lpFilePart=0x0) returned 0x31 [0149.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0149.080] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\_z9 qmoefbbr2ho.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.082] GetFileType (hFile=0x33c) returned 0x1 [0149.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0149.082] GetFileType (hFile=0x33c) returned 0x1 [0149.082] WriteFile (in: hFile=0x33c, lpBuffer=0x31e1e50*, nNumberOfBytesToWrite=0x177f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x31e1e50*, lpNumberOfBytesWritten=0x19eea0*=0x177f0, lpOverlapped=0x0) returned 1 [0149.085] CloseHandle (hObject=0x33c) returned 1 [0149.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", lpFilePart=0x0) returned 0x31 [0149.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png.coom", lpFilePart=0x0) returned 0x36 [0149.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0149.089] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\_z9 qmoefbbr2ho.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb29820, ftCreationTime.dwHighDateTime=0x1d826f7, ftLastAccessTime.dwLowDateTime=0x800b3010, ftLastAccessTime.dwHighDateTime=0x1d8297c, ftLastWriteTime.dwLowDateTime=0x1db5ebc4, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x177f0)) returned 1 [0149.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0149.090] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\_z9 qmoefbbr2ho.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\_z9 qmoefbbr2ho.png.coom")) returned 1 [0149.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0149.091] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu", lpFilePart=0x0) returned 0x23 [0149.091] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\", lpFilePart=0x0) returned 0x24 [0149.092] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690760 [0149.092] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.093] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892c30, ftCreationTime.dwHighDateTime=0x1d81b6b, ftLastAccessTime.dwLowDateTime=0x2f11a690, ftLastAccessTime.dwHighDateTime=0x1d82363, ftLastWriteTime.dwLowDateTime=0x2f11a690, ftLastWriteTime.dwHighDateTime=0x1d82363, nFileSizeHigh=0x0, nFileSizeLow=0x1866, dwReserved0=0x0, dwReserved1=0x0, cFileName="0b2BYJ.bmp", cAlternateFileName="")) returned 1 [0149.093] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8329e890, ftCreationTime.dwHighDateTime=0x1d82413, ftLastAccessTime.dwLowDateTime=0x2e51fa0, ftLastAccessTime.dwHighDateTime=0x1d826c6, ftLastWriteTime.dwLowDateTime=0x2e51fa0, ftLastWriteTime.dwHighDateTime=0x1d826c6, nFileSizeHigh=0x0, nFileSizeLow=0xa084, dwReserved0=0x0, dwReserved1=0x0, cFileName="bCDo3xL3DQNnY-NDn8o.csv", cAlternateFileName="BCDO3X~1.CSV")) returned 1 [0149.093] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75560, ftCreationTime.dwHighDateTime=0x1d8242d, ftLastAccessTime.dwLowDateTime=0x42763500, ftLastAccessTime.dwHighDateTime=0x1d82711, ftLastWriteTime.dwLowDateTime=0x42763500, ftLastWriteTime.dwHighDateTime=0x1d82711, nFileSizeHigh=0x0, nFileSizeLow=0x7551, dwReserved0=0x0, dwReserved1=0x0, cFileName="BP7Hlx-dC.docx", cAlternateFileName="BP7HLX~1.DOC")) returned 1 [0149.094] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f277160, ftCreationTime.dwHighDateTime=0x1d82782, ftLastAccessTime.dwLowDateTime=0x1a8090e0, ftLastAccessTime.dwHighDateTime=0x1d827ca, ftLastWriteTime.dwLowDateTime=0x1a8090e0, ftLastWriteTime.dwHighDateTime=0x1d827ca, nFileSizeHigh=0x0, nFileSizeLow=0xeee5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPcUPq7bjO.gif", cAlternateFileName="FPCUPQ~1.GIF")) returned 1 [0149.094] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821f4fc0, ftCreationTime.dwHighDateTime=0x1d8271b, ftLastAccessTime.dwLowDateTime=0x8071e040, ftLastAccessTime.dwHighDateTime=0x1d827ff, ftLastWriteTime.dwLowDateTime=0x8071e040, ftLastWriteTime.dwHighDateTime=0x1d827ff, nFileSizeHigh=0x0, nFileSizeLow=0xdd89, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTPNUNi5N0PRF7q49.flv", cAlternateFileName="HTPNUN~1.FLV")) returned 1 [0149.094] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lohkShS91M7hT3L", cAlternateFileName="LOHKSH~1")) returned 1 [0149.095] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lohkShS91M7hT3L", cAlternateFileName="LOHKSH~1")) returned 0 [0149.096] FindClose (in: hFindFile=0x690760 | out: hFindFile=0x690760) returned 1 [0149.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1 [0149.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1 [0149.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0149.096] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu", lpFilePart=0x0) returned 0x23 [0149.096] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\", lpFilePart=0x0) returned 0x24 [0149.097] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690560 [0149.098] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.098] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892c30, ftCreationTime.dwHighDateTime=0x1d81b6b, ftLastAccessTime.dwLowDateTime=0x2f11a690, ftLastAccessTime.dwHighDateTime=0x1d82363, ftLastWriteTime.dwLowDateTime=0x2f11a690, ftLastWriteTime.dwHighDateTime=0x1d82363, nFileSizeHigh=0x0, nFileSizeLow=0x1866, dwReserved0=0x0, dwReserved1=0x0, cFileName="0b2BYJ.bmp", cAlternateFileName="")) returned 1 [0149.099] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8329e890, ftCreationTime.dwHighDateTime=0x1d82413, ftLastAccessTime.dwLowDateTime=0x2e51fa0, ftLastAccessTime.dwHighDateTime=0x1d826c6, ftLastWriteTime.dwLowDateTime=0x2e51fa0, ftLastWriteTime.dwHighDateTime=0x1d826c6, nFileSizeHigh=0x0, nFileSizeLow=0xa084, dwReserved0=0x0, dwReserved1=0x0, cFileName="bCDo3xL3DQNnY-NDn8o.csv", cAlternateFileName="BCDO3X~1.CSV")) returned 1 [0149.100] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75560, ftCreationTime.dwHighDateTime=0x1d8242d, ftLastAccessTime.dwLowDateTime=0x42763500, ftLastAccessTime.dwHighDateTime=0x1d82711, ftLastWriteTime.dwLowDateTime=0x42763500, ftLastWriteTime.dwHighDateTime=0x1d82711, nFileSizeHigh=0x0, nFileSizeLow=0x7551, dwReserved0=0x0, dwReserved1=0x0, cFileName="BP7Hlx-dC.docx", cAlternateFileName="BP7HLX~1.DOC")) returned 1 [0149.101] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f277160, ftCreationTime.dwHighDateTime=0x1d82782, ftLastAccessTime.dwLowDateTime=0x1a8090e0, ftLastAccessTime.dwHighDateTime=0x1d827ca, ftLastWriteTime.dwLowDateTime=0x1a8090e0, ftLastWriteTime.dwHighDateTime=0x1d827ca, nFileSizeHigh=0x0, nFileSizeLow=0xeee5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPcUPq7bjO.gif", cAlternateFileName="FPCUPQ~1.GIF")) returned 1 [0149.101] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821f4fc0, ftCreationTime.dwHighDateTime=0x1d8271b, ftLastAccessTime.dwLowDateTime=0x8071e040, ftLastAccessTime.dwHighDateTime=0x1d827ff, ftLastWriteTime.dwLowDateTime=0x8071e040, ftLastWriteTime.dwHighDateTime=0x1d827ff, nFileSizeHigh=0x0, nFileSizeLow=0xdd89, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTPNUNi5N0PRF7q49.flv", cAlternateFileName="HTPNUN~1.FLV")) returned 1 [0149.102] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lohkShS91M7hT3L", cAlternateFileName="LOHKSH~1")) returned 1 [0149.103] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0149.103] FindClose (in: hFindFile=0x690560 | out: hFindFile=0x690560) returned 1 [0149.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1 [0149.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1 [0149.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", nBufferLength=0x105, lpBuffer=0x19e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", lpFilePart=0x0) returned 0x2e [0149.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1 [0149.107] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\0b2byj.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.107] GetFileType (hFile=0x33c) returned 0x1 [0149.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1 [0149.107] GetFileType (hFile=0x33c) returned 0x1 [0149.107] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19eec4 | out: lpFileSizeHigh=0x19eec4*=0x0) returned 0x1866 [0149.107] ReadFile (in: hFile=0x33c, lpBuffer=0x21db074, nNumberOfBytesToRead=0x1866, lpNumberOfBytesRead=0x19ee70, lpOverlapped=0x0 | out: lpBuffer=0x21db074*, lpNumberOfBytesRead=0x19ee70*=0x1866, lpOverlapped=0x0) returned 1 [0149.109] CloseHandle (hObject=0x33c) returned 1 [0149.207] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", nBufferLength=0x105, lpBuffer=0x19e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", lpFilePart=0x0) returned 0x2e [0149.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eda4) returned 1 [0149.207] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\0b2byj.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.381] GetFileType (hFile=0x33c) returned 0x1 [0149.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda0) returned 1 [0149.381] GetFileType (hFile=0x33c) returned 0x1 [0149.381] WriteFile (in: hFile=0x33c, lpBuffer=0x222f9c4*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x19ee60, lpOverlapped=0x0 | out: lpBuffer=0x222f9c4*, lpNumberOfBytesWritten=0x19ee60*=0x1870, lpOverlapped=0x0) returned 1 [0149.382] CloseHandle (hObject=0x33c) returned 1 [0149.384] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", lpFilePart=0x0) returned 0x2e [0149.384] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp.coom", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp.coom", lpFilePart=0x0) returned 0x33 [0149.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee48) returned 1 [0149.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\0b2byj.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19eec4 | out: lpFileInformation=0x19eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892c30, ftCreationTime.dwHighDateTime=0x1d81b6b, ftLastAccessTime.dwLowDateTime=0x2f11a690, ftLastAccessTime.dwHighDateTime=0x1d82363, ftLastWriteTime.dwLowDateTime=0x1de2ec6e, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x1870)) returned 1 [0149.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee44) returned 1 [0149.384] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\0b2byj.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\0b2byj.bmp.coom")) returned 1 [0149.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", nBufferLength=0x105, lpBuffer=0x19e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", lpFilePart=0x0) returned 0x3b [0149.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1 [0149.385] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bcdo3xl3dqnny-ndn8o.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.385] GetFileType (hFile=0x33c) returned 0x1 [0149.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1 [0149.385] GetFileType (hFile=0x33c) returned 0x1 [0149.385] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19eec4 | out: lpFileSizeHigh=0x19eec4*=0x0) returned 0xa084 [0149.385] ReadFile (in: hFile=0x33c, lpBuffer=0x22315b4, nNumberOfBytesToRead=0xa084, lpNumberOfBytesRead=0x19ee70, lpOverlapped=0x0 | out: lpBuffer=0x22315b4*, lpNumberOfBytesRead=0x19ee70*=0xa084, lpOverlapped=0x0) returned 1 [0149.387] CloseHandle (hObject=0x33c) returned 1 [0149.408] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", nBufferLength=0x105, lpBuffer=0x19e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", lpFilePart=0x0) returned 0x3b [0149.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eda4) returned 1 [0149.408] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bcdo3xl3dqnny-ndn8o.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.410] GetFileType (hFile=0x33c) returned 0x1 [0149.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda0) returned 1 [0149.410] GetFileType (hFile=0x33c) returned 0x1 [0149.410] WriteFile (in: hFile=0x33c, lpBuffer=0x22b0644*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x19ee60, lpOverlapped=0x0 | out: lpBuffer=0x22b0644*, lpNumberOfBytesWritten=0x19ee60*=0xa090, lpOverlapped=0x0) returned 1 [0149.418] CloseHandle (hObject=0x33c) returned 1 [0149.420] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", lpFilePart=0x0) returned 0x3b [0149.420] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv.coom", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv.coom", lpFilePart=0x0) returned 0x40 [0149.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee48) returned 1 [0149.420] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bcdo3xl3dqnny-ndn8o.csv"), fInfoLevelId=0x0, lpFileInformation=0x19eec4 | out: lpFileInformation=0x19eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8329e890, ftCreationTime.dwHighDateTime=0x1d82413, ftLastAccessTime.dwLowDateTime=0x2e51fa0, ftLastAccessTime.dwHighDateTime=0x1d826c6, ftLastWriteTime.dwLowDateTime=0x1de872ea, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xa090)) returned 1 [0149.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee44) returned 1 [0149.421] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bcdo3xl3dqnny-ndn8o.csv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bcdo3xl3dqnny-ndn8o.csv.coom")) returned 1 [0149.422] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", nBufferLength=0x105, lpBuffer=0x19e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", lpFilePart=0x0) returned 0x32 [0149.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1 [0149.422] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bp7hlx-dc.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.422] GetFileType (hFile=0x33c) returned 0x1 [0149.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1 [0149.422] GetFileType (hFile=0x33c) returned 0x1 [0149.422] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19eec4 | out: lpFileSizeHigh=0x19eec4*=0x0) returned 0x7551 [0149.422] ReadFile (in: hFile=0x33c, lpBuffer=0x22baab4, nNumberOfBytesToRead=0x7551, lpNumberOfBytesRead=0x19ee70, lpOverlapped=0x0 | out: lpBuffer=0x22baab4*, lpNumberOfBytesRead=0x19ee70*=0x7551, lpOverlapped=0x0) returned 1 [0149.423] CloseHandle (hObject=0x33c) returned 1 [0149.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", nBufferLength=0x105, lpBuffer=0x19e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", lpFilePart=0x0) returned 0x32 [0149.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eda4) returned 1 [0149.445] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bp7hlx-dc.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.447] GetFileType (hFile=0x33c) returned 0x1 [0149.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda0) returned 1 [0149.447] GetFileType (hFile=0x33c) returned 0x1 [0149.447] WriteFile (in: hFile=0x33c, lpBuffer=0x232c358*, nNumberOfBytesToWrite=0x7560, lpNumberOfBytesWritten=0x19ee60, lpOverlapped=0x0 | out: lpBuffer=0x232c358*, lpNumberOfBytesWritten=0x19ee60*=0x7560, lpOverlapped=0x0) returned 1 [0149.449] CloseHandle (hObject=0x33c) returned 1 [0149.451] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", lpFilePart=0x0) returned 0x32 [0149.451] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx.coom", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx.coom", lpFilePart=0x0) returned 0x37 [0149.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee48) returned 1 [0149.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bp7hlx-dc.docx"), fInfoLevelId=0x0, lpFileInformation=0x19eec4 | out: lpFileInformation=0x19eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75560, ftCreationTime.dwHighDateTime=0x1d8242d, ftLastAccessTime.dwLowDateTime=0x42763500, ftLastAccessTime.dwHighDateTime=0x1d82711, ftLastWriteTime.dwLowDateTime=0x1ded2d2c, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7560)) returned 1 [0149.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee44) returned 1 [0149.453] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bp7hlx-dc.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bp7hlx-dc.docx.coom")) returned 1 [0149.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", nBufferLength=0x105, lpBuffer=0x19e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", lpFilePart=0x0) returned 0x39 [0149.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1 [0149.454] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\htpnuni5n0prf7q49.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.454] GetFileType (hFile=0x33c) returned 0x1 [0149.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1 [0149.455] GetFileType (hFile=0x33c) returned 0x1 [0149.455] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19eec4 | out: lpFileSizeHigh=0x19eec4*=0x0) returned 0xdd89 [0149.455] ReadFile (in: hFile=0x33c, lpBuffer=0x2333c70, nNumberOfBytesToRead=0xdd89, lpNumberOfBytesRead=0x19ee70, lpOverlapped=0x0 | out: lpBuffer=0x2333c70*, lpNumberOfBytesRead=0x19ee70*=0xdd89, lpOverlapped=0x0) returned 1 [0149.456] CloseHandle (hObject=0x33c) returned 1 [0149.478] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", nBufferLength=0x105, lpBuffer=0x19e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", lpFilePart=0x0) returned 0x39 [0149.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eda4) returned 1 [0149.478] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\htpnuni5n0prf7q49.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.480] GetFileType (hFile=0x33c) returned 0x1 [0149.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda0) returned 1 [0149.480] GetFileType (hFile=0x33c) returned 0x1 [0149.480] WriteFile (in: hFile=0x33c, lpBuffer=0x23aa2f8*, nNumberOfBytesToWrite=0xdd90, lpNumberOfBytesWritten=0x19ee60, lpOverlapped=0x0 | out: lpBuffer=0x23aa2f8*, lpNumberOfBytesWritten=0x19ee60*=0xdd90, lpOverlapped=0x0) returned 1 [0149.482] CloseHandle (hObject=0x33c) returned 1 [0149.485] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", lpFilePart=0x0) returned 0x39 [0149.485] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv.coom", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv.coom", lpFilePart=0x0) returned 0x3e [0149.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee48) returned 1 [0149.485] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\htpnuni5n0prf7q49.flv"), fInfoLevelId=0x0, lpFileInformation=0x19eec4 | out: lpFileInformation=0x19eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821f4fc0, ftCreationTime.dwHighDateTime=0x1d8271b, ftLastAccessTime.dwLowDateTime=0x8071e040, ftLastAccessTime.dwHighDateTime=0x1d827ff, ftLastWriteTime.dwLowDateTime=0x1df269cf, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xdd90)) returned 1 [0149.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee44) returned 1 [0149.486] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\htpnuni5n0prf7q49.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\htpnuni5n0prf7q49.flv.coom")) returned 1 [0149.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0149.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L", nBufferLength=0x105, lpBuffer=0x19e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L", lpFilePart=0x0) returned 0x33 [0149.487] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\", nBufferLength=0x105, lpBuffer=0x19e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\", lpFilePart=0x0) returned 0x34 [0149.487] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\*", lpFindFileData=0x19ebb0 | out: lpFindFileData=0x19ebb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6907e0 [0149.487] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.487] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90cf040, ftCreationTime.dwHighDateTime=0x1d8236f, ftLastAccessTime.dwLowDateTime=0x8b446180, ftLastAccessTime.dwHighDateTime=0x1d827e8, ftLastWriteTime.dwLowDateTime=0x8b446180, ftLastWriteTime.dwHighDateTime=0x1d827e8, nFileSizeHigh=0x0, nFileSizeLow=0x9946, dwReserved0=0x0, dwReserved1=0x0, cFileName="- iPNtWwPnLb_xVEK.xlsx", cAlternateFileName="-IPNTW~1.XLS")) returned 1 [0149.488] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4e5350, ftCreationTime.dwHighDateTime=0x1d81e80, ftLastAccessTime.dwLowDateTime=0x51c497c0, ftLastAccessTime.dwHighDateTime=0x1d82876, ftLastWriteTime.dwLowDateTime=0x51c497c0, ftLastWriteTime.dwHighDateTime=0x1d82876, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="a0LPQFabf2-tcp.flv", cAlternateFileName="A0LPQF~1.FLV")) returned 1 [0149.488] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc14880, ftCreationTime.dwHighDateTime=0x1d825c4, ftLastAccessTime.dwLowDateTime=0x3f193060, ftLastAccessTime.dwHighDateTime=0x1d8285b, ftLastWriteTime.dwLowDateTime=0x3f193060, ftLastWriteTime.dwHighDateTime=0x1d8285b, nFileSizeHigh=0x0, nFileSizeLow=0x16b29, dwReserved0=0x0, dwReserved1=0x0, cFileName="J1sasodaPu-SvRdJT307.gif", cAlternateFileName="J1SASO~1.GIF")) returned 1 [0149.488] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76dc4df0, ftCreationTime.dwHighDateTime=0x1d82407, ftLastAccessTime.dwLowDateTime=0xcf922140, ftLastAccessTime.dwHighDateTime=0x1d82425, ftLastWriteTime.dwLowDateTime=0xcf922140, ftLastWriteTime.dwHighDateTime=0x1d82425, nFileSizeHigh=0x0, nFileSizeLow=0xf6c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="T3Pjk61xtk9Sizl9Gz7.jpg", cAlternateFileName="T3PJK6~1.JPG")) returned 1 [0149.488] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc390e1f0, ftCreationTime.dwHighDateTime=0x1d82516, ftLastAccessTime.dwLowDateTime=0xbe82c120, ftLastAccessTime.dwHighDateTime=0x1d82740, ftLastWriteTime.dwLowDateTime=0xbe82c120, ftLastWriteTime.dwHighDateTime=0x1d82740, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wy9hdiHoa5p6DL6.wav", cAlternateFileName="WY9HDI~1.WAV")) returned 1 [0149.492] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0149.492] FindClose (in: hFindFile=0x6907e0 | out: hFindFile=0x6907e0) returned 1 [0149.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee48) returned 1 [0149.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee54) returned 1 [0149.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0149.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L", nBufferLength=0x105, lpBuffer=0x19e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L", lpFilePart=0x0) returned 0x33 [0149.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\", nBufferLength=0x105, lpBuffer=0x19e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\", lpFilePart=0x0) returned 0x34 [0149.492] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\*", lpFindFileData=0x19ebb0 | out: lpFindFileData=0x19ebb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6907e0 [0149.493] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.493] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90cf040, ftCreationTime.dwHighDateTime=0x1d8236f, ftLastAccessTime.dwLowDateTime=0x8b446180, ftLastAccessTime.dwHighDateTime=0x1d827e8, ftLastWriteTime.dwLowDateTime=0x8b446180, ftLastWriteTime.dwHighDateTime=0x1d827e8, nFileSizeHigh=0x0, nFileSizeLow=0x9946, dwReserved0=0x0, dwReserved1=0x0, cFileName="- iPNtWwPnLb_xVEK.xlsx", cAlternateFileName="-IPNTW~1.XLS")) returned 1 [0149.493] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4e5350, ftCreationTime.dwHighDateTime=0x1d81e80, ftLastAccessTime.dwLowDateTime=0x51c497c0, ftLastAccessTime.dwHighDateTime=0x1d82876, ftLastWriteTime.dwLowDateTime=0x51c497c0, ftLastWriteTime.dwHighDateTime=0x1d82876, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="a0LPQFabf2-tcp.flv", cAlternateFileName="A0LPQF~1.FLV")) returned 1 [0149.494] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc14880, ftCreationTime.dwHighDateTime=0x1d825c4, ftLastAccessTime.dwLowDateTime=0x3f193060, ftLastAccessTime.dwHighDateTime=0x1d8285b, ftLastWriteTime.dwLowDateTime=0x3f193060, ftLastWriteTime.dwHighDateTime=0x1d8285b, nFileSizeHigh=0x0, nFileSizeLow=0x16b29, dwReserved0=0x0, dwReserved1=0x0, cFileName="J1sasodaPu-SvRdJT307.gif", cAlternateFileName="J1SASO~1.GIF")) returned 1 [0149.494] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76dc4df0, ftCreationTime.dwHighDateTime=0x1d82407, ftLastAccessTime.dwLowDateTime=0xcf922140, ftLastAccessTime.dwHighDateTime=0x1d82425, ftLastWriteTime.dwLowDateTime=0xcf922140, ftLastWriteTime.dwHighDateTime=0x1d82425, nFileSizeHigh=0x0, nFileSizeLow=0xf6c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="T3Pjk61xtk9Sizl9Gz7.jpg", cAlternateFileName="T3PJK6~1.JPG")) returned 1 [0149.494] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc390e1f0, ftCreationTime.dwHighDateTime=0x1d82516, ftLastAccessTime.dwLowDateTime=0xbe82c120, ftLastAccessTime.dwHighDateTime=0x1d82740, ftLastWriteTime.dwLowDateTime=0xbe82c120, ftLastWriteTime.dwHighDateTime=0x1d82740, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wy9hdiHoa5p6DL6.wav", cAlternateFileName="WY9HDI~1.WAV")) returned 1 [0149.494] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc390e1f0, ftCreationTime.dwHighDateTime=0x1d82516, ftLastAccessTime.dwLowDateTime=0xbe82c120, ftLastAccessTime.dwHighDateTime=0x1d82740, ftLastWriteTime.dwLowDateTime=0xbe82c120, ftLastWriteTime.dwHighDateTime=0x1d82740, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wy9hdiHoa5p6DL6.wav", cAlternateFileName="WY9HDI~1.WAV")) returned 0 [0149.494] FindClose (in: hFindFile=0x6907e0 | out: hFindFile=0x6907e0) returned 1 [0149.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee48) returned 1 [0149.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee54) returned 1 [0149.495] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", nBufferLength=0x105, lpBuffer=0x19e888, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", lpFilePart=0x0) returned 0x4a [0149.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed7c) returned 1 [0149.495] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\- ipntwwpnlb_xvek.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.495] GetFileType (hFile=0x33c) returned 0x1 [0149.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed78) returned 1 [0149.495] GetFileType (hFile=0x33c) returned 0x1 [0149.495] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0x9946 [0149.495] ReadFile (in: hFile=0x33c, lpBuffer=0x23bab48, nNumberOfBytesToRead=0x9946, lpNumberOfBytesRead=0x19ee30, lpOverlapped=0x0 | out: lpBuffer=0x23bab48*, lpNumberOfBytesRead=0x19ee30*=0x9946, lpOverlapped=0x0) returned 1 [0149.498] CloseHandle (hObject=0x33c) returned 1 [0149.564] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", nBufferLength=0x105, lpBuffer=0x19e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", lpFilePart=0x0) returned 0x4a [0149.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed64) returned 1 [0149.564] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\- ipntwwpnlb_xvek.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.569] GetFileType (hFile=0x33c) returned 0x1 [0149.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0149.569] GetFileType (hFile=0x33c) returned 0x1 [0149.569] WriteFile (in: hFile=0x33c, lpBuffer=0x2241af8*, nNumberOfBytesToWrite=0x9950, lpNumberOfBytesWritten=0x19ee20, lpOverlapped=0x0 | out: lpBuffer=0x2241af8*, lpNumberOfBytesWritten=0x19ee20*=0x9950, lpOverlapped=0x0) returned 1 [0149.572] CloseHandle (hObject=0x33c) returned 1 [0149.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", lpFilePart=0x0) returned 0x4a [0149.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx.coom", lpFilePart=0x0) returned 0x4f [0149.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee08) returned 1 [0149.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\- ipntwwpnlb_xvek.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ee84 | out: lpFileInformation=0x19ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90cf040, ftCreationTime.dwHighDateTime=0x1d8236f, ftLastAccessTime.dwLowDateTime=0x8b446180, ftLastAccessTime.dwHighDateTime=0x1d827e8, ftLastWriteTime.dwLowDateTime=0x1e0061cf, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x9950)) returned 1 [0149.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee04) returned 1 [0149.578] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\- ipntwwpnlb_xvek.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\- ipntwwpnlb_xvek.xlsx.coom")) returned 1 [0149.579] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", nBufferLength=0x105, lpBuffer=0x19e888, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", lpFilePart=0x0) returned 0x46 [0149.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed7c) returned 1 [0149.579] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\a0lpqfabf2-tcp.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.580] GetFileType (hFile=0x33c) returned 0x1 [0149.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed78) returned 1 [0149.580] GetFileType (hFile=0x33c) returned 0x1 [0149.580] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0x6b8 [0149.580] ReadFile (in: hFile=0x33c, lpBuffer=0x224bf94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee30, lpOverlapped=0x0 | out: lpBuffer=0x224bf94*, lpNumberOfBytesRead=0x19ee30*=0x6b8, lpOverlapped=0x0) returned 1 [0149.581] CloseHandle (hObject=0x33c) returned 1 [0149.806] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", nBufferLength=0x105, lpBuffer=0x19e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", lpFilePart=0x0) returned 0x46 [0149.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed64) returned 1 [0149.806] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\a0lpqfabf2-tcp.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.807] GetFileType (hFile=0x33c) returned 0x1 [0149.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0149.807] GetFileType (hFile=0x33c) returned 0x1 [0149.807] WriteFile (in: hFile=0x33c, lpBuffer=0x229c1b0*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x19edf4, lpOverlapped=0x0 | out: lpBuffer=0x229c1b0*, lpNumberOfBytesWritten=0x19edf4*=0x6c0, lpOverlapped=0x0) returned 1 [0149.809] CloseHandle (hObject=0x33c) returned 1 [0149.810] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", lpFilePart=0x0) returned 0x46 [0149.810] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv.coom", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv.coom", lpFilePart=0x0) returned 0x4b [0149.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee08) returned 1 [0149.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\a0lpqfabf2-tcp.flv"), fInfoLevelId=0x0, lpFileInformation=0x19ee84 | out: lpFileInformation=0x19ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4e5350, ftCreationTime.dwHighDateTime=0x1d81e80, ftLastAccessTime.dwLowDateTime=0x51c497c0, ftLastAccessTime.dwHighDateTime=0x1d82876, ftLastWriteTime.dwLowDateTime=0x1e240127, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x6c0)) returned 1 [0149.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee04) returned 1 [0149.811] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\a0lpqfabf2-tcp.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\a0lpqfabf2-tcp.flv.coom")) returned 1 [0149.811] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", nBufferLength=0x105, lpBuffer=0x19e888, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", lpFilePart=0x0) returned 0x4b [0149.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed7c) returned 1 [0149.812] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\t3pjk61xtk9sizl9gz7.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.812] GetFileType (hFile=0x33c) returned 0x1 [0149.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed78) returned 1 [0149.812] GetFileType (hFile=0x33c) returned 0x1 [0149.812] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0xf6c2 [0149.812] ReadFile (in: hFile=0x33c, lpBuffer=0x229d50c, nNumberOfBytesToRead=0xf6c2, lpNumberOfBytesRead=0x19ee30, lpOverlapped=0x0 | out: lpBuffer=0x229d50c*, lpNumberOfBytesRead=0x19ee30*=0xf6c2, lpOverlapped=0x0) returned 1 [0149.813] CloseHandle (hObject=0x33c) returned 1 [0149.835] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", nBufferLength=0x105, lpBuffer=0x19e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", lpFilePart=0x0) returned 0x4b [0149.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed64) returned 1 [0149.835] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\t3pjk61xtk9sizl9gz7.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.837] GetFileType (hFile=0x33c) returned 0x1 [0149.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0149.838] GetFileType (hFile=0x33c) returned 0x1 [0149.838] WriteFile (in: hFile=0x33c, lpBuffer=0x2318754*, nNumberOfBytesToWrite=0xf6d0, lpNumberOfBytesWritten=0x19ee20, lpOverlapped=0x0 | out: lpBuffer=0x2318754*, lpNumberOfBytesWritten=0x19ee20*=0xf6d0, lpOverlapped=0x0) returned 1 [0149.843] CloseHandle (hObject=0x33c) returned 1 [0149.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", lpFilePart=0x0) returned 0x4b [0149.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg.coom", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg.coom", lpFilePart=0x0) returned 0x50 [0149.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee08) returned 1 [0149.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\t3pjk61xtk9sizl9gz7.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ee84 | out: lpFileInformation=0x19ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76dc4df0, ftCreationTime.dwHighDateTime=0x1d82407, ftLastAccessTime.dwLowDateTime=0xcf922140, ftLastAccessTime.dwHighDateTime=0x1d82425, ftLastWriteTime.dwLowDateTime=0x1e2992a8, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xf6d0)) returned 1 [0149.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee04) returned 1 [0149.847] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\t3pjk61xtk9sizl9gz7.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\t3pjk61xtk9sizl9gz7.jpg.coom")) returned 1 [0149.848] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", nBufferLength=0x105, lpBuffer=0x19e888, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", lpFilePart=0x0) returned 0x47 [0149.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed7c) returned 1 [0149.848] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\wy9hdihoa5p6dl6.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.850] GetFileType (hFile=0x33c) returned 0x1 [0149.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed78) returned 1 [0149.850] GetFileType (hFile=0x33c) returned 0x1 [0149.850] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0x2366 [0149.851] ReadFile (in: hFile=0x33c, lpBuffer=0x23282b4, nNumberOfBytesToRead=0x2366, lpNumberOfBytesRead=0x19ee30, lpOverlapped=0x0 | out: lpBuffer=0x23282b4*, lpNumberOfBytesRead=0x19ee30*=0x2366, lpOverlapped=0x0) returned 1 [0149.852] CloseHandle (hObject=0x33c) returned 1 [0149.898] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", nBufferLength=0x105, lpBuffer=0x19e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", lpFilePart=0x0) returned 0x47 [0149.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed64) returned 1 [0149.899] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\wy9hdihoa5p6dl6.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c [0149.901] GetFileType (hFile=0x33c) returned 0x1 [0149.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1 [0149.901] GetFileType (hFile=0x33c) returned 0x1 [0149.901] WriteFile (in: hFile=0x33c, lpBuffer=0x23801a8*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x19ee20, lpOverlapped=0x0 | out: lpBuffer=0x23801a8*, lpNumberOfBytesWritten=0x19ee20*=0x2370, lpOverlapped=0x0) returned 1 [0149.903] CloseHandle (hObject=0x33c) returned 1 [0149.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", lpFilePart=0x0) returned 0x47 [0149.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav.coom", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav.coom", lpFilePart=0x0) returned 0x4c [0149.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee08) returned 1 [0149.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\wy9hdihoa5p6dl6.wav"), fInfoLevelId=0x0, lpFileInformation=0x19ee84 | out: lpFileInformation=0x19ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc390e1f0, ftCreationTime.dwHighDateTime=0x1d82516, ftLastAccessTime.dwLowDateTime=0xbe82c120, ftLastAccessTime.dwHighDateTime=0x1d82740, ftLastWriteTime.dwLowDateTime=0x1e325e88, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x2370)) returned 1 [0149.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee04) returned 1 [0149.905] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\wy9hdihoa5p6dl6.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\wy9hdihoa5p6dl6.wav.coom")) returned 1 [0149.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1 [0149.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads", lpFilePart=0x0) returned 0x1f [0149.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads\\", lpFilePart=0x0) returned 0x20 [0149.906] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690a60 [0149.906] FindNextFileW (in: hFindFile=0x690a60, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.907] FindNextFileW (in: hFindFile=0x690a60, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.907] FindNextFileW (in: hFindFile=0x690a60, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0149.907] FindClose (in: hFindFile=0x690a60 | out: hFindFile=0x690a60) returned 1 [0149.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1 [0149.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1 [0149.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1 [0149.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads", lpFilePart=0x0) returned 0x1f [0149.908] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads\\", lpFilePart=0x0) returned 0x20 [0149.908] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690560 [0149.908] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.908] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.909] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0149.909] FindClose (in: hFindFile=0x690560 | out: hFindFile=0x690560) returned 1 [0149.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1 [0149.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1 [0149.920] CoTaskMemAlloc (cb=0x20c) returned 0x6c0078 [0149.920] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x6c0078 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 0x0 [0149.922] CoTaskMemFree (pv=0x6c0078) [0149.922] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19e9dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0149.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1 [0149.922] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0149.922] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20 [0149.922] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfdace1e5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfdace1e5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690560 [0149.923] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfdace1e5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfdace1e5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.925] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1943c5e0, ftCreationTime.dwHighDateTime=0x1d819fa, ftLastAccessTime.dwLowDateTime=0x5f4803e0, ftLastAccessTime.dwHighDateTime=0x1d81b48, ftLastWriteTime.dwLowDateTime=0x5f4803e0, ftLastWriteTime.dwHighDateTime=0x1d81b48, nFileSizeHigh=0x0, nFileSizeLow=0xb923, dwReserved0=0x0, dwReserved1=0x0, cFileName="0tvBM_QdD3TVO2ZA_6P.ods", cAlternateFileName="0TVBM_~1.ODS")) returned 1 [0149.926] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8408450, ftCreationTime.dwHighDateTime=0x1d82055, ftLastAccessTime.dwLowDateTime=0x97412920, ftLastAccessTime.dwHighDateTime=0x1d825e8, ftLastWriteTime.dwLowDateTime=0x97412920, ftLastWriteTime.dwHighDateTime=0x1d825e8, nFileSizeHigh=0x0, nFileSizeLow=0x1835e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1gCPCj5iJQW.csv", cAlternateFileName="1GCPCJ~1.CSV")) returned 1 [0149.926] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11230f20, ftCreationTime.dwHighDateTime=0x1d81deb, ftLastAccessTime.dwLowDateTime=0x9111cb40, ftLastAccessTime.dwHighDateTime=0x1d8294e, ftLastWriteTime.dwLowDateTime=0x9111cb40, ftLastWriteTime.dwHighDateTime=0x1d8294e, nFileSizeHigh=0x0, nFileSizeLow=0x10457, dwReserved0=0x0, dwReserved1=0x0, cFileName="1yj7pDeYv0wl_14KUOPt.rtf", cAlternateFileName="1YJ7PD~1.RTF")) returned 1 [0149.926] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1db8ab0, ftCreationTime.dwHighDateTime=0x1d81a84, ftLastAccessTime.dwLowDateTime=0xfb521090, ftLastAccessTime.dwHighDateTime=0x1d8290e, ftLastWriteTime.dwLowDateTime=0xfb521090, ftLastWriteTime.dwHighDateTime=0x1d8290e, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="22yziHM7PYbi2OW6R.pdf", cAlternateFileName="22YZIH~1.PDF")) returned 1 [0149.926] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a472260, ftCreationTime.dwHighDateTime=0x1d7c456, ftLastAccessTime.dwLowDateTime=0x2e7ac760, ftLastAccessTime.dwHighDateTime=0x1d7d48b, ftLastWriteTime.dwLowDateTime=0x2e7ac760, ftLastWriteTime.dwHighDateTime=0x1d7d48b, nFileSizeHigh=0x0, nFileSizeLow=0xd31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2qxTT.pptx", cAlternateFileName="2QXTT~1.PPT")) returned 1 [0149.926] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d86690, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0x4418c370, ftLastAccessTime.dwHighDateTime=0x1d826fb, ftLastWriteTime.dwLowDateTime=0x4418c370, ftLastWriteTime.dwHighDateTime=0x1d826fb, nFileSizeHigh=0x0, nFileSizeLow=0x9ed1, dwReserved0=0x0, dwReserved1=0x0, cFileName="3wHRRlh-2tUJE8.doc", cAlternateFileName="3WHRRL~1.DOC")) returned 1 [0149.927] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f4c480, ftCreationTime.dwHighDateTime=0x1d8299f, ftLastAccessTime.dwLowDateTime=0xa3827650, ftLastAccessTime.dwHighDateTime=0x1d829e7, ftLastWriteTime.dwLowDateTime=0xa3827650, ftLastWriteTime.dwHighDateTime=0x1d829e7, nFileSizeHigh=0x0, nFileSizeLow=0x1751b, dwReserved0=0x0, dwReserved1=0x0, cFileName="5BYO.pptx", cAlternateFileName="5BYO~1.PPT")) returned 1 [0149.927] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316d7680, ftCreationTime.dwHighDateTime=0x1d82066, ftLastAccessTime.dwLowDateTime=0x2ca42980, ftLastAccessTime.dwHighDateTime=0x1d82496, ftLastWriteTime.dwLowDateTime=0x2ca42980, ftLastWriteTime.dwHighDateTime=0x1d82496, nFileSizeHigh=0x0, nFileSizeLow=0x4dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="6_8C7Suq3sh2Zdvr.ppt", cAlternateFileName="6_8C7S~1.PPT")) returned 1 [0149.927] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8970c0, ftCreationTime.dwHighDateTime=0x1d808ba, ftLastAccessTime.dwLowDateTime=0xd3c996e0, ftLastAccessTime.dwHighDateTime=0x1d80c5f, ftLastWriteTime.dwLowDateTime=0xd3c996e0, ftLastWriteTime.dwHighDateTime=0x1d80c5f, nFileSizeHigh=0x0, nFileSizeLow=0xaeac, dwReserved0=0x0, dwReserved1=0x0, cFileName="7AVZTG3CoeJywumxSZt.docx", cAlternateFileName="7AVZTG~1.DOC")) returned 1 [0149.927] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c31240, ftCreationTime.dwHighDateTime=0x1d81e5a, ftLastAccessTime.dwLowDateTime=0xc96b5a10, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0xc96b5a10, ftLastWriteTime.dwHighDateTime=0x1d82737, nFileSizeHigh=0x0, nFileSizeLow=0xba63, dwReserved0=0x0, dwReserved1=0x0, cFileName="998Wb55hD8qLh4.xls", cAlternateFileName="998WB5~1.XLS")) returned 1 [0149.928] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77eb4ff0, ftCreationTime.dwHighDateTime=0x1d81a22, ftLastAccessTime.dwLowDateTime=0xc802c340, ftLastAccessTime.dwHighDateTime=0x1d81f3d, ftLastWriteTime.dwLowDateTime=0xc802c340, ftLastWriteTime.dwHighDateTime=0x1d81f3d, nFileSizeHigh=0x0, nFileSizeLow=0x17d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="A0KaGTxVHzRgl2NU.ods", cAlternateFileName="A0KAGT~1.ODS")) returned 1 [0149.928] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e388c50, ftCreationTime.dwHighDateTime=0x1d8230e, ftLastAccessTime.dwLowDateTime=0xb9f606f0, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0xb9f606f0, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0xbdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ai3doif_i6aorCOuoq.docx", cAlternateFileName="AI3DOI~1.DOC")) returned 1 [0149.928] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f3e0b0, ftCreationTime.dwHighDateTime=0x1d82304, ftLastAccessTime.dwLowDateTime=0x92fdc3e0, ftLastAccessTime.dwHighDateTime=0x1d82779, ftLastWriteTime.dwLowDateTime=0x92fdc3e0, ftLastWriteTime.dwHighDateTime=0x1d82779, nFileSizeHigh=0x0, nFileSizeLow=0x178c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cJ6K_Ys9JTdNtND8.xlsx", cAlternateFileName="CJ6K_Y~1.XLS")) returned 1 [0149.928] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4372e947, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.929] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2eacf0, ftCreationTime.dwHighDateTime=0x1d820b9, ftLastAccessTime.dwLowDateTime=0xe23b67c0, ftLastAccessTime.dwHighDateTime=0x1d8242a, ftLastWriteTime.dwLowDateTime=0xe23b67c0, ftLastWriteTime.dwHighDateTime=0x1d8242a, nFileSizeHigh=0x0, nFileSizeLow=0x14b17, dwReserved0=0x0, dwReserved1=0x0, cFileName="Di-uCCpaTx9R5q.ots", cAlternateFileName="DI-UCC~1.OTS")) returned 1 [0149.929] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650ad7f0, ftCreationTime.dwHighDateTime=0x1d7fad0, ftLastAccessTime.dwLowDateTime=0xa78efc20, ftLastAccessTime.dwHighDateTime=0x1d7fafb, ftLastWriteTime.dwLowDateTime=0xa78efc20, ftLastWriteTime.dwHighDateTime=0x1d7fafb, nFileSizeHigh=0x0, nFileSizeLow=0x15a24, dwReserved0=0x0, dwReserved1=0x0, cFileName="DkBw3ckGM uF2SMdXz.pptx", cAlternateFileName="DKBW3C~1.PPT")) returned 1 [0149.929] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b23a4f0, ftCreationTime.dwHighDateTime=0x1d82157, ftLastAccessTime.dwLowDateTime=0x1ca905c0, ftLastAccessTime.dwHighDateTime=0x1d82412, ftLastWriteTime.dwLowDateTime=0x1ca905c0, ftLastWriteTime.dwHighDateTime=0x1d82412, nFileSizeHigh=0x0, nFileSizeLow=0x184fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="dXzsJ7_sQ.rtf", cAlternateFileName="DXZSJ7~1.RTF")) returned 1 [0149.929] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaafcff60, ftCreationTime.dwHighDateTime=0x1d79da9, ftLastAccessTime.dwLowDateTime=0x28a85380, ftLastAccessTime.dwHighDateTime=0x1d7d8d6, ftLastWriteTime.dwLowDateTime=0x28a85380, ftLastWriteTime.dwHighDateTime=0x1d7d8d6, nFileSizeHigh=0x0, nFileSizeLow=0x3aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="FgTsNOb7Ndvo.xlsx", cAlternateFileName="FGTSNO~1.XLS")) returned 1 [0149.930] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeafe250, ftCreationTime.dwHighDateTime=0x1d7fd14, ftLastAccessTime.dwLowDateTime=0xbc177e80, ftLastAccessTime.dwHighDateTime=0x1d81e21, ftLastWriteTime.dwLowDateTime=0xbc177e80, ftLastWriteTime.dwHighDateTime=0x1d81e21, nFileSizeHigh=0x0, nFileSizeLow=0x18249, dwReserved0=0x0, dwReserved1=0x0, cFileName="fiE7zb85t8B-.pptx", cAlternateFileName="FIE7ZB~1.PPT")) returned 1 [0149.933] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb79abd10, ftCreationTime.dwHighDateTime=0x1d8209f, ftLastAccessTime.dwLowDateTime=0x2f5d36e0, ftLastAccessTime.dwHighDateTime=0x1d82837, ftLastWriteTime.dwLowDateTime=0x2f5d36e0, ftLastWriteTime.dwHighDateTime=0x1d82837, nFileSizeHigh=0x0, nFileSizeLow=0x14e20, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXtU7tJGkArCUt.pptx", cAlternateFileName="FXTU7T~1.PPT")) returned 1 [0149.933] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a84d640, ftCreationTime.dwHighDateTime=0x1d81dbc, ftLastAccessTime.dwLowDateTime=0x5c6943a0, ftLastAccessTime.dwHighDateTime=0x1d826dd, ftLastWriteTime.dwLowDateTime=0x5c6943a0, ftLastWriteTime.dwHighDateTime=0x1d826dd, nFileSizeHigh=0x0, nFileSizeLow=0x5c48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gxt7.rtf", cAlternateFileName="")) returned 1 [0149.934] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fdf1610, ftCreationTime.dwHighDateTime=0x1d81eff, ftLastAccessTime.dwLowDateTime=0x7ae89d30, ftLastAccessTime.dwHighDateTime=0x1d8207f, ftLastWriteTime.dwLowDateTime=0x7ae89d30, ftLastWriteTime.dwHighDateTime=0x1d8207f, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="h8t-RSY oy1WSABM.csv", cAlternateFileName="H8T-RS~1.CSV")) returned 1 [0149.945] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899e2e40, ftCreationTime.dwHighDateTime=0x1d81cf5, ftLastAccessTime.dwLowDateTime=0x5d7c3b20, ftLastAccessTime.dwHighDateTime=0x1d81e96, ftLastWriteTime.dwLowDateTime=0x5d7c3b20, ftLastWriteTime.dwHighDateTime=0x1d81e96, nFileSizeHigh=0x0, nFileSizeLow=0xf2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgaKU.odt", cAlternateFileName="")) returned 1 [0149.945] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f402890, ftCreationTime.dwHighDateTime=0x1d7ba24, ftLastAccessTime.dwLowDateTime=0x7255a3c0, ftLastAccessTime.dwHighDateTime=0x1d7ea74, ftLastWriteTime.dwLowDateTime=0x7255a3c0, ftLastWriteTime.dwHighDateTime=0x1d7ea74, nFileSizeHigh=0x0, nFileSizeLow=0xef62, dwReserved0=0x0, dwReserved1=0x0, cFileName="iriH.docx", cAlternateFileName="IRIH~1.DOC")) returned 1 [0149.945] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee2c490, ftCreationTime.dwHighDateTime=0x1d81b1c, ftLastAccessTime.dwLowDateTime=0x3c989e80, ftLastAccessTime.dwHighDateTime=0x1d81fe0, ftLastWriteTime.dwLowDateTime=0x3c989e80, ftLastWriteTime.dwHighDateTime=0x1d81fe0, nFileSizeHigh=0x0, nFileSizeLow=0x454b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSv2CXAx0sO0nwq3.docx", cAlternateFileName="ISV2CX~1.DOC")) returned 1 [0149.945] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf5fa0, ftCreationTime.dwHighDateTime=0x1d824fe, ftLastAccessTime.dwLowDateTime=0x2639b3f0, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0x2639b3f0, ftLastWriteTime.dwHighDateTime=0x1d82737, nFileSizeHigh=0x0, nFileSizeLow=0x7e53, dwReserved0=0x0, dwReserved1=0x0, cFileName="LXAm.xlsx", cAlternateFileName="LXAM~1.XLS")) returned 1 [0149.946] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927389f0, ftCreationTime.dwHighDateTime=0x1d7a9b1, ftLastAccessTime.dwLowDateTime=0x6cd7edd0, ftLastAccessTime.dwHighDateTime=0x1d7eb15, ftLastWriteTime.dwLowDateTime=0x6cd7edd0, ftLastWriteTime.dwHighDateTime=0x1d7eb15, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LXf5O1UnE8gZ7VPN-X.docx", cAlternateFileName="LXF5O1~1.DOC")) returned 1 [0149.946] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4f2f040, ftCreationTime.dwHighDateTime=0x1d7feac, ftLastAccessTime.dwLowDateTime=0x4744cb10, ftLastAccessTime.dwHighDateTime=0x1d82774, ftLastWriteTime.dwLowDateTime=0x4744cb10, ftLastWriteTime.dwHighDateTime=0x1d82774, nFileSizeHigh=0x0, nFileSizeLow=0x6776, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lxh6PbYU5lGk0.pptx", cAlternateFileName="LXH6PB~1.PPT")) returned 1 [0149.946] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eb80d0, ftCreationTime.dwHighDateTime=0x1d82436, ftLastAccessTime.dwLowDateTime=0x25fb4ab0, ftLastAccessTime.dwHighDateTime=0x1d825df, ftLastWriteTime.dwLowDateTime=0x25fb4ab0, ftLastWriteTime.dwHighDateTime=0x1d825df, nFileSizeHigh=0x0, nFileSizeLow=0x107a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="lyrRYp D-2Z.docx", cAlternateFileName="LYRRYP~1.DOC")) returned 1 [0149.946] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02879f0, ftCreationTime.dwHighDateTime=0x1d826fb, ftLastAccessTime.dwLowDateTime=0xc3865040, ftLastAccessTime.dwHighDateTime=0x1d827ab, ftLastWriteTime.dwLowDateTime=0xc3865040, ftLastWriteTime.dwHighDateTime=0x1d827ab, nFileSizeHigh=0x0, nFileSizeLow=0x13bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNffSwckP FbcIEuI5.doc", cAlternateFileName="MSNFFS~1.DOC")) returned 1 [0149.946] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0149.947] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0149.947] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0149.948] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe55e5d0, ftCreationTime.dwHighDateTime=0x1d81cad, ftLastAccessTime.dwLowDateTime=0xb079e420, ftLastAccessTime.dwHighDateTime=0x1d824d2, ftLastWriteTime.dwLowDateTime=0xb079e420, ftLastWriteTime.dwHighDateTime=0x1d824d2, nFileSizeHigh=0x0, nFileSizeLow=0x3e19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="n7hKHIqS.rtf", cAlternateFileName="")) returned 1 [0149.948] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc50c0, ftCreationTime.dwHighDateTime=0x1d819fd, ftLastAccessTime.dwLowDateTime=0x5f903f90, ftLastAccessTime.dwHighDateTime=0x1d81b8c, ftLastWriteTime.dwLowDateTime=0x5f903f90, ftLastWriteTime.dwHighDateTime=0x1d81b8c, nFileSizeHigh=0x0, nFileSizeLow=0xf85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ocgatxC-6Ez0Hk_y.xls", cAlternateFileName="OCGATX~1.XLS")) returned 1 [0149.948] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x65ef9a5c, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0149.948] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f827a60, ftCreationTime.dwHighDateTime=0x1d81dca, ftLastAccessTime.dwLowDateTime=0x59dd3ca0, ftLastAccessTime.dwHighDateTime=0x1d823df, ftLastWriteTime.dwLowDateTime=0x59dd3ca0, ftLastWriteTime.dwHighDateTime=0x1d823df, nFileSizeHigh=0x0, nFileSizeLow=0xa3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="owF5pa QZMhBD.rtf", cAlternateFileName="OWF5PA~1.RTF")) returned 1 [0149.948] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc572d180, ftCreationTime.dwHighDateTime=0x1d8296d, ftLastAccessTime.dwLowDateTime=0x9b0dd40, ftLastAccessTime.dwHighDateTime=0x1d829f2, ftLastWriteTime.dwLowDateTime=0x9b0dd40, ftLastWriteTime.dwHighDateTime=0x1d829f2, nFileSizeHigh=0x0, nFileSizeLow=0x4953, dwReserved0=0x0, dwReserved1=0x0, cFileName="p9uL--tRL_6UnNWprC.odt", cAlternateFileName="P9UL--~1.ODT")) returned 1 [0149.949] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc60980, ftCreationTime.dwHighDateTime=0x1d829a0, ftLastAccessTime.dwLowDateTime=0xa1794260, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0xa1794260, ftLastWriteTime.dwHighDateTime=0x1d829f3, nFileSizeHigh=0x0, nFileSizeLow=0x12344, dwReserved0=0x0, dwReserved1=0x0, cFileName="pSJLpn8DrUrz1-Xy6Fw_.pdf", cAlternateFileName="PSJLPN~1.PDF")) returned 1 [0149.949] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6810580, ftCreationTime.dwHighDateTime=0x1d819e3, ftLastAccessTime.dwLowDateTime=0x3c8de40, ftLastAccessTime.dwHighDateTime=0x1d81ed6, ftLastWriteTime.dwLowDateTime=0x3c8de40, ftLastWriteTime.dwHighDateTime=0x1d81ed6, nFileSizeHigh=0x0, nFileSizeLow=0x10b71, dwReserved0=0x0, dwReserved1=0x0, cFileName="q9j2C2vhqGqT8Y.xls", cAlternateFileName="Q9J2C2~1.XLS")) returned 1 [0149.949] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8100020, ftCreationTime.dwHighDateTime=0x1d81323, ftLastAccessTime.dwLowDateTime=0x5835a220, ftLastAccessTime.dwHighDateTime=0x1d821a5, ftLastWriteTime.dwLowDateTime=0x5835a220, ftLastWriteTime.dwHighDateTime=0x1d821a5, nFileSizeHigh=0x0, nFileSizeLow=0x1160, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qi06Dg7iSL hMONv94Db.xlsx", cAlternateFileName="QI06DG~1.XLS")) returned 1 [0149.949] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31a5460, ftCreationTime.dwHighDateTime=0x1d8274a, ftLastAccessTime.dwLowDateTime=0x744511a0, ftLastAccessTime.dwHighDateTime=0x1d82883, ftLastWriteTime.dwLowDateTime=0x744511a0, ftLastWriteTime.dwHighDateTime=0x1d82883, nFileSizeHigh=0x0, nFileSizeLow=0x11ef1, dwReserved0=0x0, dwReserved1=0x0, cFileName="QqWlqDBqRFVAm vqX4DG.pdf", cAlternateFileName="QQWLQD~1.PDF")) returned 1 [0149.949] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38867ac0, ftCreationTime.dwHighDateTime=0x1d827b9, ftLastAccessTime.dwLowDateTime=0x342424e0, ftLastAccessTime.dwHighDateTime=0x1d82823, ftLastWriteTime.dwLowDateTime=0x342424e0, ftLastWriteTime.dwHighDateTime=0x1d82823, nFileSizeHigh=0x0, nFileSizeLow=0x8e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="r6Cg4NKEaRK.ots", cAlternateFileName="R6CG4N~1.OTS")) returned 1 [0149.950] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d63a50, ftCreationTime.dwHighDateTime=0x1d81e3b, ftLastAccessTime.dwLowDateTime=0x72d93c00, ftLastAccessTime.dwHighDateTime=0x1d82988, ftLastWriteTime.dwLowDateTime=0x72d93c00, ftLastWriteTime.dwHighDateTime=0x1d82988, nFileSizeHigh=0x0, nFileSizeLow=0xcfc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDG1tR6SD8R 70ytf.docx", cAlternateFileName="TDG1TR~1.DOC")) returned 1 [0149.950] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53efdbf0, ftCreationTime.dwHighDateTime=0x1d821c2, ftLastAccessTime.dwLowDateTime=0x74932200, ftLastAccessTime.dwHighDateTime=0x1d8270c, ftLastWriteTime.dwLowDateTime=0x74932200, ftLastWriteTime.dwHighDateTime=0x1d8270c, nFileSizeHigh=0x0, nFileSizeLow=0x57f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="uhTnuhWyZPoex.pdf", cAlternateFileName="UHTNUH~1.PDF")) returned 1 [0149.950] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6982eec0, ftCreationTime.dwHighDateTime=0x1d7bba7, ftLastAccessTime.dwLowDateTime=0xbbf9d860, ftLastAccessTime.dwHighDateTime=0x1d7d567, ftLastWriteTime.dwLowDateTime=0xbbf9d860, ftLastWriteTime.dwHighDateTime=0x1d7d567, nFileSizeHigh=0x0, nFileSizeLow=0x5c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="uIwqDmYW8Ql.docx", cAlternateFileName="UIWQDM~1.DOC")) returned 1 [0149.950] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdba143d0, ftCreationTime.dwHighDateTime=0x1d81ec1, ftLastAccessTime.dwLowDateTime=0x1494afb0, ftLastAccessTime.dwHighDateTime=0x1d8202f, ftLastWriteTime.dwLowDateTime=0x1494afb0, ftLastWriteTime.dwHighDateTime=0x1d8202f, nFileSizeHigh=0x0, nFileSizeLow=0x17d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcYEH.doc", cAlternateFileName="")) returned 1 [0149.950] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c075f0, ftCreationTime.dwHighDateTime=0x1d7dd97, ftLastAccessTime.dwLowDateTime=0x3bac3590, ftLastAccessTime.dwHighDateTime=0x1d81aa4, ftLastWriteTime.dwLowDateTime=0x3bac3590, ftLastWriteTime.dwHighDateTime=0x1d81aa4, nFileSizeHigh=0x0, nFileSizeLow=0x79d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="wlZTxESTUgU f3.xlsx", cAlternateFileName="WLZTXE~1.XLS")) returned 1 [0149.951] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61beb0, ftCreationTime.dwHighDateTime=0x1d81aa5, ftLastAccessTime.dwLowDateTime=0x48b00210, ftLastAccessTime.dwHighDateTime=0x1d823ca, ftLastWriteTime.dwLowDateTime=0x48b00210, ftLastWriteTime.dwHighDateTime=0x1d823ca, nFileSizeHigh=0x0, nFileSizeLow=0x16363, dwReserved0=0x0, dwReserved1=0x0, cFileName="WU7S.xls", cAlternateFileName="")) returned 1 [0149.951] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x199007f0, ftCreationTime.dwHighDateTime=0x1d8218b, ftLastAccessTime.dwLowDateTime=0x3e7a2700, ftLastAccessTime.dwHighDateTime=0x1d826f7, ftLastWriteTime.dwLowDateTime=0x3e7a2700, ftLastWriteTime.dwHighDateTime=0x1d826f7, nFileSizeHigh=0x0, nFileSizeLow=0x7e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="wVE9flHzacBjM.pptx", cAlternateFileName="WVE9FL~1.PPT")) returned 1 [0149.951] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148e4700, ftCreationTime.dwHighDateTime=0x1d7e3ea, ftLastAccessTime.dwLowDateTime=0xbefc52e0, ftLastAccessTime.dwHighDateTime=0x1d819d7, ftLastWriteTime.dwLowDateTime=0xbefc52e0, ftLastWriteTime.dwHighDateTime=0x1d819d7, nFileSizeHigh=0x0, nFileSizeLow=0x5a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="y8TckRi KxxqHv9oqq.xlsx", cAlternateFileName="Y8TCKR~1.XLS")) returned 1 [0149.951] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc5da00, ftCreationTime.dwHighDateTime=0x1d7d439, ftLastAccessTime.dwLowDateTime=0xc0d81010, ftLastAccessTime.dwHighDateTime=0x1d7f1bc, ftLastWriteTime.dwLowDateTime=0xc0d81010, ftLastWriteTime.dwHighDateTime=0x1d7f1bc, nFileSizeHigh=0x0, nFileSizeLow=0x17858, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZJRfdPfcL.xlsx", cAlternateFileName="ZJRFDP~1.XLS")) returned 1 [0149.952] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd083fcf0, ftCreationTime.dwHighDateTime=0x1d823c5, ftLastAccessTime.dwLowDateTime=0x7d735750, ftLastAccessTime.dwHighDateTime=0x1d8240f, ftLastWriteTime.dwLowDateTime=0x7d735750, ftLastWriteTime.dwHighDateTime=0x1d8240f, nFileSizeHigh=0x0, nFileSizeLow=0x16987, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZWAFqo.pps", cAlternateFileName="")) returned 1 [0149.952] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0149.952] FindClose (in: hFindFile=0x690560 | out: hFindFile=0x690560) returned 1 [0149.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1 [0149.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1 [0149.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1 [0149.952] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0149.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20 [0149.953] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfdace1e5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfdace1e5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690ae0 [0149.955] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfdace1e5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfdace1e5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.955] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1943c5e0, ftCreationTime.dwHighDateTime=0x1d819fa, ftLastAccessTime.dwLowDateTime=0x5f4803e0, ftLastAccessTime.dwHighDateTime=0x1d81b48, ftLastWriteTime.dwLowDateTime=0x5f4803e0, ftLastWriteTime.dwHighDateTime=0x1d81b48, nFileSizeHigh=0x0, nFileSizeLow=0xb923, dwReserved0=0x0, dwReserved1=0x0, cFileName="0tvBM_QdD3TVO2ZA_6P.ods", cAlternateFileName="0TVBM_~1.ODS")) returned 1 [0149.955] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8408450, ftCreationTime.dwHighDateTime=0x1d82055, ftLastAccessTime.dwLowDateTime=0x97412920, ftLastAccessTime.dwHighDateTime=0x1d825e8, ftLastWriteTime.dwLowDateTime=0x97412920, ftLastWriteTime.dwHighDateTime=0x1d825e8, nFileSizeHigh=0x0, nFileSizeLow=0x1835e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1gCPCj5iJQW.csv", cAlternateFileName="1GCPCJ~1.CSV")) returned 1 [0149.956] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11230f20, ftCreationTime.dwHighDateTime=0x1d81deb, ftLastAccessTime.dwLowDateTime=0x9111cb40, ftLastAccessTime.dwHighDateTime=0x1d8294e, ftLastWriteTime.dwLowDateTime=0x9111cb40, ftLastWriteTime.dwHighDateTime=0x1d8294e, nFileSizeHigh=0x0, nFileSizeLow=0x10457, dwReserved0=0x0, dwReserved1=0x0, cFileName="1yj7pDeYv0wl_14KUOPt.rtf", cAlternateFileName="1YJ7PD~1.RTF")) returned 1 [0149.956] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1db8ab0, ftCreationTime.dwHighDateTime=0x1d81a84, ftLastAccessTime.dwLowDateTime=0xfb521090, ftLastAccessTime.dwHighDateTime=0x1d8290e, ftLastWriteTime.dwLowDateTime=0xfb521090, ftLastWriteTime.dwHighDateTime=0x1d8290e, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="22yziHM7PYbi2OW6R.pdf", cAlternateFileName="22YZIH~1.PDF")) returned 1 [0149.956] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a472260, ftCreationTime.dwHighDateTime=0x1d7c456, ftLastAccessTime.dwLowDateTime=0x2e7ac760, ftLastAccessTime.dwHighDateTime=0x1d7d48b, ftLastWriteTime.dwLowDateTime=0x2e7ac760, ftLastWriteTime.dwHighDateTime=0x1d7d48b, nFileSizeHigh=0x0, nFileSizeLow=0xd31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2qxTT.pptx", cAlternateFileName="2QXTT~1.PPT")) returned 1 [0149.956] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d86690, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0x4418c370, ftLastAccessTime.dwHighDateTime=0x1d826fb, ftLastWriteTime.dwLowDateTime=0x4418c370, ftLastWriteTime.dwHighDateTime=0x1d826fb, nFileSizeHigh=0x0, nFileSizeLow=0x9ed1, dwReserved0=0x0, dwReserved1=0x0, cFileName="3wHRRlh-2tUJE8.doc", cAlternateFileName="3WHRRL~1.DOC")) returned 1 [0149.957] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f4c480, ftCreationTime.dwHighDateTime=0x1d8299f, ftLastAccessTime.dwLowDateTime=0xa3827650, ftLastAccessTime.dwHighDateTime=0x1d829e7, ftLastWriteTime.dwLowDateTime=0xa3827650, ftLastWriteTime.dwHighDateTime=0x1d829e7, nFileSizeHigh=0x0, nFileSizeLow=0x1751b, dwReserved0=0x0, dwReserved1=0x0, cFileName="5BYO.pptx", cAlternateFileName="5BYO~1.PPT")) returned 1 [0149.957] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316d7680, ftCreationTime.dwHighDateTime=0x1d82066, ftLastAccessTime.dwLowDateTime=0x2ca42980, ftLastAccessTime.dwHighDateTime=0x1d82496, ftLastWriteTime.dwLowDateTime=0x2ca42980, ftLastWriteTime.dwHighDateTime=0x1d82496, nFileSizeHigh=0x0, nFileSizeLow=0x4dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="6_8C7Suq3sh2Zdvr.ppt", cAlternateFileName="6_8C7S~1.PPT")) returned 1 [0149.957] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8970c0, ftCreationTime.dwHighDateTime=0x1d808ba, ftLastAccessTime.dwLowDateTime=0xd3c996e0, ftLastAccessTime.dwHighDateTime=0x1d80c5f, ftLastWriteTime.dwLowDateTime=0xd3c996e0, ftLastWriteTime.dwHighDateTime=0x1d80c5f, nFileSizeHigh=0x0, nFileSizeLow=0xaeac, dwReserved0=0x0, dwReserved1=0x0, cFileName="7AVZTG3CoeJywumxSZt.docx", cAlternateFileName="7AVZTG~1.DOC")) returned 1 [0149.958] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c31240, ftCreationTime.dwHighDateTime=0x1d81e5a, ftLastAccessTime.dwLowDateTime=0xc96b5a10, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0xc96b5a10, ftLastWriteTime.dwHighDateTime=0x1d82737, nFileSizeHigh=0x0, nFileSizeLow=0xba63, dwReserved0=0x0, dwReserved1=0x0, cFileName="998Wb55hD8qLh4.xls", cAlternateFileName="998WB5~1.XLS")) returned 1 [0149.958] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77eb4ff0, ftCreationTime.dwHighDateTime=0x1d81a22, ftLastAccessTime.dwLowDateTime=0xc802c340, ftLastAccessTime.dwHighDateTime=0x1d81f3d, ftLastWriteTime.dwLowDateTime=0xc802c340, ftLastWriteTime.dwHighDateTime=0x1d81f3d, nFileSizeHigh=0x0, nFileSizeLow=0x17d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="A0KaGTxVHzRgl2NU.ods", cAlternateFileName="A0KAGT~1.ODS")) returned 1 [0149.958] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e388c50, ftCreationTime.dwHighDateTime=0x1d8230e, ftLastAccessTime.dwLowDateTime=0xb9f606f0, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0xb9f606f0, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0xbdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ai3doif_i6aorCOuoq.docx", cAlternateFileName="AI3DOI~1.DOC")) returned 1 [0149.958] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f3e0b0, ftCreationTime.dwHighDateTime=0x1d82304, ftLastAccessTime.dwLowDateTime=0x92fdc3e0, ftLastAccessTime.dwHighDateTime=0x1d82779, ftLastWriteTime.dwLowDateTime=0x92fdc3e0, ftLastWriteTime.dwHighDateTime=0x1d82779, nFileSizeHigh=0x0, nFileSizeLow=0x178c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cJ6K_Ys9JTdNtND8.xlsx", cAlternateFileName="CJ6K_Y~1.XLS")) returned 1 [0149.959] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4372e947, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0149.959] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2eacf0, ftCreationTime.dwHighDateTime=0x1d820b9, ftLastAccessTime.dwLowDateTime=0xe23b67c0, ftLastAccessTime.dwHighDateTime=0x1d8242a, ftLastWriteTime.dwLowDateTime=0xe23b67c0, ftLastWriteTime.dwHighDateTime=0x1d8242a, nFileSizeHigh=0x0, nFileSizeLow=0x14b17, dwReserved0=0x0, dwReserved1=0x0, cFileName="Di-uCCpaTx9R5q.ots", cAlternateFileName="DI-UCC~1.OTS")) returned 1 [0149.959] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650ad7f0, ftCreationTime.dwHighDateTime=0x1d7fad0, ftLastAccessTime.dwLowDateTime=0xa78efc20, ftLastAccessTime.dwHighDateTime=0x1d7fafb, ftLastWriteTime.dwLowDateTime=0xa78efc20, ftLastWriteTime.dwHighDateTime=0x1d7fafb, nFileSizeHigh=0x0, nFileSizeLow=0x15a24, dwReserved0=0x0, dwReserved1=0x0, cFileName="DkBw3ckGM uF2SMdXz.pptx", cAlternateFileName="DKBW3C~1.PPT")) returned 1 [0149.960] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b23a4f0, ftCreationTime.dwHighDateTime=0x1d82157, ftLastAccessTime.dwLowDateTime=0x1ca905c0, ftLastAccessTime.dwHighDateTime=0x1d82412, ftLastWriteTime.dwLowDateTime=0x1ca905c0, ftLastWriteTime.dwHighDateTime=0x1d82412, nFileSizeHigh=0x0, nFileSizeLow=0x184fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="dXzsJ7_sQ.rtf", cAlternateFileName="DXZSJ7~1.RTF")) returned 1 [0149.960] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaafcff60, ftCreationTime.dwHighDateTime=0x1d79da9, ftLastAccessTime.dwLowDateTime=0x28a85380, ftLastAccessTime.dwHighDateTime=0x1d7d8d6, ftLastWriteTime.dwLowDateTime=0x28a85380, ftLastWriteTime.dwHighDateTime=0x1d7d8d6, nFileSizeHigh=0x0, nFileSizeLow=0x3aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="FgTsNOb7Ndvo.xlsx", cAlternateFileName="FGTSNO~1.XLS")) returned 1 [0149.960] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeafe250, ftCreationTime.dwHighDateTime=0x1d7fd14, ftLastAccessTime.dwLowDateTime=0xbc177e80, ftLastAccessTime.dwHighDateTime=0x1d81e21, ftLastWriteTime.dwLowDateTime=0xbc177e80, ftLastWriteTime.dwHighDateTime=0x1d81e21, nFileSizeHigh=0x0, nFileSizeLow=0x18249, dwReserved0=0x0, dwReserved1=0x0, cFileName="fiE7zb85t8B-.pptx", cAlternateFileName="FIE7ZB~1.PPT")) returned 1 [0149.960] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb79abd10, ftCreationTime.dwHighDateTime=0x1d8209f, ftLastAccessTime.dwLowDateTime=0x2f5d36e0, ftLastAccessTime.dwHighDateTime=0x1d82837, ftLastWriteTime.dwLowDateTime=0x2f5d36e0, ftLastWriteTime.dwHighDateTime=0x1d82837, nFileSizeHigh=0x0, nFileSizeLow=0x14e20, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXtU7tJGkArCUt.pptx", cAlternateFileName="FXTU7T~1.PPT")) returned 1 [0149.961] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a84d640, ftCreationTime.dwHighDateTime=0x1d81dbc, ftLastAccessTime.dwLowDateTime=0x5c6943a0, ftLastAccessTime.dwHighDateTime=0x1d826dd, ftLastWriteTime.dwLowDateTime=0x5c6943a0, ftLastWriteTime.dwHighDateTime=0x1d826dd, nFileSizeHigh=0x0, nFileSizeLow=0x5c48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gxt7.rtf", cAlternateFileName="")) returned 1 [0149.961] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fdf1610, ftCreationTime.dwHighDateTime=0x1d81eff, ftLastAccessTime.dwLowDateTime=0x7ae89d30, ftLastAccessTime.dwHighDateTime=0x1d8207f, ftLastWriteTime.dwLowDateTime=0x7ae89d30, ftLastWriteTime.dwHighDateTime=0x1d8207f, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="h8t-RSY oy1WSABM.csv", cAlternateFileName="H8T-RS~1.CSV")) returned 1 [0149.961] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899e2e40, ftCreationTime.dwHighDateTime=0x1d81cf5, ftLastAccessTime.dwLowDateTime=0x5d7c3b20, ftLastAccessTime.dwHighDateTime=0x1d81e96, ftLastWriteTime.dwLowDateTime=0x5d7c3b20, ftLastWriteTime.dwHighDateTime=0x1d81e96, nFileSizeHigh=0x0, nFileSizeLow=0xf2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgaKU.odt", cAlternateFileName="")) returned 1 [0149.961] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f402890, ftCreationTime.dwHighDateTime=0x1d7ba24, ftLastAccessTime.dwLowDateTime=0x7255a3c0, ftLastAccessTime.dwHighDateTime=0x1d7ea74, ftLastWriteTime.dwLowDateTime=0x7255a3c0, ftLastWriteTime.dwHighDateTime=0x1d7ea74, nFileSizeHigh=0x0, nFileSizeLow=0xef62, dwReserved0=0x0, dwReserved1=0x0, cFileName="iriH.docx", cAlternateFileName="IRIH~1.DOC")) returned 1 [0149.962] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee2c490, ftCreationTime.dwHighDateTime=0x1d81b1c, ftLastAccessTime.dwLowDateTime=0x3c989e80, ftLastAccessTime.dwHighDateTime=0x1d81fe0, ftLastWriteTime.dwLowDateTime=0x3c989e80, ftLastWriteTime.dwHighDateTime=0x1d81fe0, nFileSizeHigh=0x0, nFileSizeLow=0x454b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSv2CXAx0sO0nwq3.docx", cAlternateFileName="ISV2CX~1.DOC")) returned 1 [0149.962] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf5fa0, ftCreationTime.dwHighDateTime=0x1d824fe, ftLastAccessTime.dwLowDateTime=0x2639b3f0, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0x2639b3f0, ftLastWriteTime.dwHighDateTime=0x1d82737, nFileSizeHigh=0x0, nFileSizeLow=0x7e53, dwReserved0=0x0, dwReserved1=0x0, cFileName="LXAm.xlsx", cAlternateFileName="LXAM~1.XLS")) returned 1 [0149.962] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927389f0, ftCreationTime.dwHighDateTime=0x1d7a9b1, ftLastAccessTime.dwLowDateTime=0x6cd7edd0, ftLastAccessTime.dwHighDateTime=0x1d7eb15, ftLastWriteTime.dwLowDateTime=0x6cd7edd0, ftLastWriteTime.dwHighDateTime=0x1d7eb15, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LXf5O1UnE8gZ7VPN-X.docx", cAlternateFileName="LXF5O1~1.DOC")) returned 1 [0149.962] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4f2f040, ftCreationTime.dwHighDateTime=0x1d7feac, ftLastAccessTime.dwLowDateTime=0x4744cb10, ftLastAccessTime.dwHighDateTime=0x1d82774, ftLastWriteTime.dwLowDateTime=0x4744cb10, ftLastWriteTime.dwHighDateTime=0x1d82774, nFileSizeHigh=0x0, nFileSizeLow=0x6776, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lxh6PbYU5lGk0.pptx", cAlternateFileName="LXH6PB~1.PPT")) returned 1 [0149.963] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eb80d0, ftCreationTime.dwHighDateTime=0x1d82436, ftLastAccessTime.dwLowDateTime=0x25fb4ab0, ftLastAccessTime.dwHighDateTime=0x1d825df, ftLastWriteTime.dwLowDateTime=0x25fb4ab0, ftLastWriteTime.dwHighDateTime=0x1d825df, nFileSizeHigh=0x0, nFileSizeLow=0x107a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="lyrRYp D-2Z.docx", cAlternateFileName="LYRRYP~1.DOC")) returned 1 [0149.963] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02879f0, ftCreationTime.dwHighDateTime=0x1d826fb, ftLastAccessTime.dwLowDateTime=0xc3865040, ftLastAccessTime.dwHighDateTime=0x1d827ab, ftLastWriteTime.dwLowDateTime=0xc3865040, ftLastWriteTime.dwHighDateTime=0x1d827ab, nFileSizeHigh=0x0, nFileSizeLow=0x13bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNffSwckP FbcIEuI5.doc", cAlternateFileName="MSNFFS~1.DOC")) returned 1 [0149.963] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0149.963] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0149.963] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0149.964] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe55e5d0, ftCreationTime.dwHighDateTime=0x1d81cad, ftLastAccessTime.dwLowDateTime=0xb079e420, ftLastAccessTime.dwHighDateTime=0x1d824d2, ftLastWriteTime.dwLowDateTime=0xb079e420, ftLastWriteTime.dwHighDateTime=0x1d824d2, nFileSizeHigh=0x0, nFileSizeLow=0x3e19, dwReserved0=0x0, dwReserved1=0x0, cFileName="n7hKHIqS.rtf", cAlternateFileName="")) returned 1 [0149.964] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc50c0, ftCreationTime.dwHighDateTime=0x1d819fd, ftLastAccessTime.dwLowDateTime=0x5f903f90, ftLastAccessTime.dwHighDateTime=0x1d81b8c, ftLastWriteTime.dwLowDateTime=0x5f903f90, ftLastWriteTime.dwHighDateTime=0x1d81b8c, nFileSizeHigh=0x0, nFileSizeLow=0xf85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ocgatxC-6Ez0Hk_y.xls", cAlternateFileName="OCGATX~1.XLS")) returned 1 [0149.964] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x65ef9a5c, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0149.964] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f827a60, ftCreationTime.dwHighDateTime=0x1d81dca, ftLastAccessTime.dwLowDateTime=0x59dd3ca0, ftLastAccessTime.dwHighDateTime=0x1d823df, ftLastWriteTime.dwLowDateTime=0x59dd3ca0, ftLastWriteTime.dwHighDateTime=0x1d823df, nFileSizeHigh=0x0, nFileSizeLow=0xa3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="owF5pa QZMhBD.rtf", cAlternateFileName="OWF5PA~1.RTF")) returned 1 [0149.965] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc572d180, ftCreationTime.dwHighDateTime=0x1d8296d, ftLastAccessTime.dwLowDateTime=0x9b0dd40, ftLastAccessTime.dwHighDateTime=0x1d829f2, ftLastWriteTime.dwLowDateTime=0x9b0dd40, ftLastWriteTime.dwHighDateTime=0x1d829f2, nFileSizeHigh=0x0, nFileSizeLow=0x4953, dwReserved0=0x0, dwReserved1=0x0, cFileName="p9uL--tRL_6UnNWprC.odt", cAlternateFileName="P9UL--~1.ODT")) returned 1 [0149.965] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc60980, ftCreationTime.dwHighDateTime=0x1d829a0, ftLastAccessTime.dwLowDateTime=0xa1794260, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0xa1794260, ftLastWriteTime.dwHighDateTime=0x1d829f3, nFileSizeHigh=0x0, nFileSizeLow=0x12344, dwReserved0=0x0, dwReserved1=0x0, cFileName="pSJLpn8DrUrz1-Xy6Fw_.pdf", cAlternateFileName="PSJLPN~1.PDF")) returned 1 [0149.966] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6810580, ftCreationTime.dwHighDateTime=0x1d819e3, ftLastAccessTime.dwLowDateTime=0x3c8de40, ftLastAccessTime.dwHighDateTime=0x1d81ed6, ftLastWriteTime.dwLowDateTime=0x3c8de40, ftLastWriteTime.dwHighDateTime=0x1d81ed6, nFileSizeHigh=0x0, nFileSizeLow=0x10b71, dwReserved0=0x0, dwReserved1=0x0, cFileName="q9j2C2vhqGqT8Y.xls", cAlternateFileName="Q9J2C2~1.XLS")) returned 1 [0149.966] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8100020, ftCreationTime.dwHighDateTime=0x1d81323, ftLastAccessTime.dwLowDateTime=0x5835a220, ftLastAccessTime.dwHighDateTime=0x1d821a5, ftLastWriteTime.dwLowDateTime=0x5835a220, ftLastWriteTime.dwHighDateTime=0x1d821a5, nFileSizeHigh=0x0, nFileSizeLow=0x1160, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qi06Dg7iSL hMONv94Db.xlsx", cAlternateFileName="QI06DG~1.XLS")) returned 1 [0149.966] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31a5460, ftCreationTime.dwHighDateTime=0x1d8274a, ftLastAccessTime.dwLowDateTime=0x744511a0, ftLastAccessTime.dwHighDateTime=0x1d82883, ftLastWriteTime.dwLowDateTime=0x744511a0, ftLastWriteTime.dwHighDateTime=0x1d82883, nFileSizeHigh=0x0, nFileSizeLow=0x11ef1, dwReserved0=0x0, dwReserved1=0x0, cFileName="QqWlqDBqRFVAm vqX4DG.pdf", cAlternateFileName="QQWLQD~1.PDF")) returned 1 [0149.966] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38867ac0, ftCreationTime.dwHighDateTime=0x1d827b9, ftLastAccessTime.dwLowDateTime=0x342424e0, ftLastAccessTime.dwHighDateTime=0x1d82823, ftLastWriteTime.dwLowDateTime=0x342424e0, ftLastWriteTime.dwHighDateTime=0x1d82823, nFileSizeHigh=0x0, nFileSizeLow=0x8e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="r6Cg4NKEaRK.ots", cAlternateFileName="R6CG4N~1.OTS")) returned 1 [0149.967] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d63a50, ftCreationTime.dwHighDateTime=0x1d81e3b, ftLastAccessTime.dwLowDateTime=0x72d93c00, ftLastAccessTime.dwHighDateTime=0x1d82988, ftLastWriteTime.dwLowDateTime=0x72d93c00, ftLastWriteTime.dwHighDateTime=0x1d82988, nFileSizeHigh=0x0, nFileSizeLow=0xcfc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDG1tR6SD8R 70ytf.docx", cAlternateFileName="TDG1TR~1.DOC")) returned 1 [0149.967] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53efdbf0, ftCreationTime.dwHighDateTime=0x1d821c2, ftLastAccessTime.dwLowDateTime=0x74932200, ftLastAccessTime.dwHighDateTime=0x1d8270c, ftLastWriteTime.dwLowDateTime=0x74932200, ftLastWriteTime.dwHighDateTime=0x1d8270c, nFileSizeHigh=0x0, nFileSizeLow=0x57f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="uhTnuhWyZPoex.pdf", cAlternateFileName="UHTNUH~1.PDF")) returned 1 [0149.967] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6982eec0, ftCreationTime.dwHighDateTime=0x1d7bba7, ftLastAccessTime.dwLowDateTime=0xbbf9d860, ftLastAccessTime.dwHighDateTime=0x1d7d567, ftLastWriteTime.dwLowDateTime=0xbbf9d860, ftLastWriteTime.dwHighDateTime=0x1d7d567, nFileSizeHigh=0x0, nFileSizeLow=0x5c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="uIwqDmYW8Ql.docx", cAlternateFileName="UIWQDM~1.DOC")) returned 1 [0149.968] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdba143d0, ftCreationTime.dwHighDateTime=0x1d81ec1, ftLastAccessTime.dwLowDateTime=0x1494afb0, ftLastAccessTime.dwHighDateTime=0x1d8202f, ftLastWriteTime.dwLowDateTime=0x1494afb0, ftLastWriteTime.dwHighDateTime=0x1d8202f, nFileSizeHigh=0x0, nFileSizeLow=0x17d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcYEH.doc", cAlternateFileName="")) returned 1 [0149.968] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c075f0, ftCreationTime.dwHighDateTime=0x1d7dd97, ftLastAccessTime.dwLowDateTime=0x3bac3590, ftLastAccessTime.dwHighDateTime=0x1d81aa4, ftLastWriteTime.dwLowDateTime=0x3bac3590, ftLastWriteTime.dwHighDateTime=0x1d81aa4, nFileSizeHigh=0x0, nFileSizeLow=0x79d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="wlZTxESTUgU f3.xlsx", cAlternateFileName="WLZTXE~1.XLS")) returned 1 [0149.968] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61beb0, ftCreationTime.dwHighDateTime=0x1d81aa5, ftLastAccessTime.dwLowDateTime=0x48b00210, ftLastAccessTime.dwHighDateTime=0x1d823ca, ftLastWriteTime.dwLowDateTime=0x48b00210, ftLastWriteTime.dwHighDateTime=0x1d823ca, nFileSizeHigh=0x0, nFileSizeLow=0x16363, dwReserved0=0x0, dwReserved1=0x0, cFileName="WU7S.xls", cAlternateFileName="")) returned 1 [0149.968] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x199007f0, ftCreationTime.dwHighDateTime=0x1d8218b, ftLastAccessTime.dwLowDateTime=0x3e7a2700, ftLastAccessTime.dwHighDateTime=0x1d826f7, ftLastWriteTime.dwLowDateTime=0x3e7a2700, ftLastWriteTime.dwHighDateTime=0x1d826f7, nFileSizeHigh=0x0, nFileSizeLow=0x7e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="wVE9flHzacBjM.pptx", cAlternateFileName="WVE9FL~1.PPT")) returned 1 [0149.969] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148e4700, ftCreationTime.dwHighDateTime=0x1d7e3ea, ftLastAccessTime.dwLowDateTime=0xbefc52e0, ftLastAccessTime.dwHighDateTime=0x1d819d7, ftLastWriteTime.dwLowDateTime=0xbefc52e0, ftLastWriteTime.dwHighDateTime=0x1d819d7, nFileSizeHigh=0x0, nFileSizeLow=0x5a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="y8TckRi KxxqHv9oqq.xlsx", cAlternateFileName="Y8TCKR~1.XLS")) returned 1 [0149.969] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc5da00, ftCreationTime.dwHighDateTime=0x1d7d439, ftLastAccessTime.dwLowDateTime=0xc0d81010, ftLastAccessTime.dwHighDateTime=0x1d7f1bc, ftLastWriteTime.dwLowDateTime=0xc0d81010, ftLastWriteTime.dwHighDateTime=0x1d7f1bc, nFileSizeHigh=0x0, nFileSizeLow=0x17858, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZJRfdPfcL.xlsx", cAlternateFileName="ZJRFDP~1.XLS")) returned 1 [0149.969] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd083fcf0, ftCreationTime.dwHighDateTime=0x1d823c5, ftLastAccessTime.dwLowDateTime=0x7d735750, ftLastAccessTime.dwHighDateTime=0x1d8240f, ftLastWriteTime.dwLowDateTime=0x7d735750, ftLastWriteTime.dwHighDateTime=0x1d8240f, nFileSizeHigh=0x0, nFileSizeLow=0x16987, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZWAFqo.pps", cAlternateFileName="")) returned 1 [0149.969] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd083fcf0, ftCreationTime.dwHighDateTime=0x1d823c5, ftLastAccessTime.dwLowDateTime=0x7d735750, ftLastAccessTime.dwHighDateTime=0x1d8240f, ftLastWriteTime.dwLowDateTime=0x7d735750, ftLastWriteTime.dwHighDateTime=0x1d8240f, nFileSizeHigh=0x0, nFileSizeLow=0x16987, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZWAFqo.pps", cAlternateFileName="")) returned 0 [0149.970] FindClose (in: hFindFile=0x690ae0 | out: hFindFile=0x690ae0) returned 1 [0149.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1 [0149.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1 [0149.970] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", lpFilePart=0x0) returned 0x37 [0149.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0149.970] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0tvbm_qdd3tvo2za_6p.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0149.971] GetFileType (hFile=0x34c) returned 0x1 [0149.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0149.971] GetFileType (hFile=0x34c) returned 0x1 [0149.971] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xb923 [0149.971] ReadFile (in: hFile=0x34c, lpBuffer=0x238eb2c, nNumberOfBytesToRead=0xb923, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x238eb2c*, lpNumberOfBytesRead=0x19eeb0*=0xb923, lpOverlapped=0x0) returned 1 [0149.972] CloseHandle (hObject=0x34c) returned 1 [0150.099] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", lpFilePart=0x0) returned 0x37 [0150.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.099] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0tvbm_qdd3tvo2za_6p.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.103] GetFileType (hFile=0x34c) returned 0x1 [0150.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.103] GetFileType (hFile=0x34c) returned 0x1 [0150.103] WriteFile (in: hFile=0x34c, lpBuffer=0x221efe4*, nNumberOfBytesToWrite=0xb930, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x221efe4*, lpNumberOfBytesWritten=0x19eea0*=0xb930, lpOverlapped=0x0) returned 1 [0150.105] CloseHandle (hObject=0x34c) returned 1 [0150.108] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", lpFilePart=0x0) returned 0x37 [0150.108] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods.coom", lpFilePart=0x0) returned 0x3c [0150.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.108] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0tvbm_qdd3tvo2za_6p.ods"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1943c5e0, ftCreationTime.dwHighDateTime=0x1d819fa, ftLastAccessTime.dwLowDateTime=0x5f4803e0, ftLastAccessTime.dwHighDateTime=0x1d81b48, ftLastWriteTime.dwLowDateTime=0x1e51704e, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xb930)) returned 1 [0150.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.108] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0tvbm_qdd3tvo2za_6p.ods"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0tvbm_qdd3tvo2za_6p.ods.coom")) returned 1 [0150.109] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", lpFilePart=0x0) returned 0x2f [0150.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.109] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1gcpcj5ijqw.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.109] GetFileType (hFile=0x34c) returned 0x1 [0150.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.110] GetFileType (hFile=0x34c) returned 0x1 [0150.110] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1835e [0150.110] ReadFile (in: hFile=0x34c, lpBuffer=0x324b180, nNumberOfBytesToRead=0x1835e, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x324b180*, lpNumberOfBytesRead=0x19eeb0*=0x1835e, lpOverlapped=0x0) returned 1 [0150.111] CloseHandle (hObject=0x34c) returned 1 [0150.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", lpFilePart=0x0) returned 0x2f [0150.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.134] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1gcpcj5ijqw.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.136] GetFileType (hFile=0x34c) returned 0x1 [0150.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.136] GetFileType (hFile=0x34c) returned 0x1 [0150.136] WriteFile (in: hFile=0x34c, lpBuffer=0x32c42a0*, nNumberOfBytesToWrite=0x18360, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x32c42a0*, lpNumberOfBytesWritten=0x19eea0*=0x18360, lpOverlapped=0x0) returned 1 [0150.141] CloseHandle (hObject=0x34c) returned 1 [0150.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", lpFilePart=0x0) returned 0x2f [0150.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv.coom", lpFilePart=0x0) returned 0x34 [0150.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.144] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1gcpcj5ijqw.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8408450, ftCreationTime.dwHighDateTime=0x1d82055, ftLastAccessTime.dwLowDateTime=0x97412920, ftLastAccessTime.dwHighDateTime=0x1d825e8, ftLastWriteTime.dwLowDateTime=0x1e56fdf5, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x18360)) returned 1 [0150.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.145] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1gcpcj5ijqw.csv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1gcpcj5ijqw.csv.coom")) returned 1 [0150.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", lpFilePart=0x0) returned 0x38 [0150.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.146] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1yj7pdeyv0wl_14kuopt.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.146] GetFileType (hFile=0x34c) returned 0x1 [0150.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.146] GetFileType (hFile=0x34c) returned 0x1 [0150.146] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x10457 [0150.146] ReadFile (in: hFile=0x34c, lpBuffer=0x2277f80, nNumberOfBytesToRead=0x10457, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2277f80*, lpNumberOfBytesRead=0x19eeb0*=0x10457, lpOverlapped=0x0) returned 1 [0150.147] CloseHandle (hObject=0x34c) returned 1 [0150.176] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", lpFilePart=0x0) returned 0x38 [0150.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.176] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1yj7pdeyv0wl_14kuopt.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.181] GetFileType (hFile=0x34c) returned 0x1 [0150.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.181] GetFileType (hFile=0x34c) returned 0x1 [0150.181] WriteFile (in: hFile=0x34c, lpBuffer=0x22f5a78*, nNumberOfBytesToWrite=0x10460, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22f5a78*, lpNumberOfBytesWritten=0x19eea0*=0x10460, lpOverlapped=0x0) returned 1 [0150.184] CloseHandle (hObject=0x34c) returned 1 [0150.187] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", lpFilePart=0x0) returned 0x38 [0150.188] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf.coom", lpFilePart=0x0) returned 0x3d [0150.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1yj7pdeyv0wl_14kuopt.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11230f20, ftCreationTime.dwHighDateTime=0x1d81deb, ftLastAccessTime.dwLowDateTime=0x9111cb40, ftLastAccessTime.dwHighDateTime=0x1d8294e, ftLastWriteTime.dwLowDateTime=0x1e5d9291, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x10460)) returned 1 [0150.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.188] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1yj7pdeyv0wl_14kuopt.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1yj7pdeyv0wl_14kuopt.rtf.coom")) returned 1 [0150.189] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", lpFilePart=0x0) returned 0x35 [0150.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.189] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\22yzihm7pybi2ow6r.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.189] GetFileType (hFile=0x34c) returned 0x1 [0150.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.190] GetFileType (hFile=0x34c) returned 0x1 [0150.190] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x4f4 [0150.190] ReadFile (in: hFile=0x34c, lpBuffer=0x23067b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23067b4*, lpNumberOfBytesRead=0x19eeb0*=0x4f4, lpOverlapped=0x0) returned 1 [0150.190] CloseHandle (hObject=0x34c) returned 1 [0150.219] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", lpFilePart=0x0) returned 0x35 [0150.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.219] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\22yzihm7pybi2ow6r.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.221] GetFileType (hFile=0x34c) returned 0x1 [0150.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.221] GetFileType (hFile=0x34c) returned 0x1 [0150.222] WriteFile (in: hFile=0x34c, lpBuffer=0x2355f98*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x19ee74, lpOverlapped=0x0 | out: lpBuffer=0x2355f98*, lpNumberOfBytesWritten=0x19ee74*=0x500, lpOverlapped=0x0) returned 1 [0150.223] CloseHandle (hObject=0x34c) returned 1 [0150.224] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", lpFilePart=0x0) returned 0x35 [0150.224] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf.coom", lpFilePart=0x0) returned 0x3a [0150.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.224] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\22yzihm7pybi2ow6r.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1db8ab0, ftCreationTime.dwHighDateTime=0x1d81a84, ftLastAccessTime.dwLowDateTime=0xfb521090, ftLastAccessTime.dwHighDateTime=0x1d8290e, ftLastWriteTime.dwLowDateTime=0x1e6332c8, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0150.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.225] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\22yzihm7pybi2ow6r.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\22yzihm7pybi2ow6r.pdf.coom")) returned 1 [0150.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", lpFilePart=0x0) returned 0x2a [0150.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.226] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2qxtt.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.226] GetFileType (hFile=0x34c) returned 0x1 [0150.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.226] GetFileType (hFile=0x34c) returned 0x1 [0150.226] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xd31d [0150.226] ReadFile (in: hFile=0x34c, lpBuffer=0x2357220, nNumberOfBytesToRead=0xd31d, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2357220*, lpNumberOfBytesRead=0x19eeb0*=0xd31d, lpOverlapped=0x0) returned 1 [0150.228] CloseHandle (hObject=0x34c) returned 1 [0150.261] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", lpFilePart=0x0) returned 0x2a [0150.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.262] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2qxtt.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.264] GetFileType (hFile=0x34c) returned 0x1 [0150.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.264] GetFileType (hFile=0x34c) returned 0x1 [0150.264] WriteFile (in: hFile=0x34c, lpBuffer=0x23cb958*, nNumberOfBytesToWrite=0xd320, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23cb958*, lpNumberOfBytesWritten=0x19eea0*=0xd320, lpOverlapped=0x0) returned 1 [0150.266] CloseHandle (hObject=0x34c) returned 1 [0150.269] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", lpFilePart=0x0) returned 0x2a [0150.269] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx.coom", lpFilePart=0x0) returned 0x2f [0150.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.270] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2qxtt.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a472260, ftCreationTime.dwHighDateTime=0x1d7c456, ftLastAccessTime.dwLowDateTime=0x2e7ac760, ftLastAccessTime.dwHighDateTime=0x1d7d48b, ftLastWriteTime.dwLowDateTime=0x1e6a1044, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xd320)) returned 1 [0150.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.270] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2qxtt.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2qxtt.pptx.coom")) returned 1 [0150.271] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", lpFilePart=0x0) returned 0x32 [0150.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.271] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3whrrlh-2tuje8.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.271] GetFileType (hFile=0x34c) returned 0x1 [0150.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.272] GetFileType (hFile=0x34c) returned 0x1 [0150.272] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x9ed1 [0150.272] ReadFile (in: hFile=0x34c, lpBuffer=0x23d8fc0, nNumberOfBytesToRead=0x9ed1, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23d8fc0*, lpNumberOfBytesRead=0x19eeb0*=0x9ed1, lpOverlapped=0x0) returned 1 [0150.272] CloseHandle (hObject=0x34c) returned 1 [0150.345] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", lpFilePart=0x0) returned 0x32 [0150.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.346] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3whrrlh-2tuje8.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.348] GetFileType (hFile=0x34c) returned 0x1 [0150.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.348] GetFileType (hFile=0x34c) returned 0x1 [0150.348] WriteFile (in: hFile=0x34c, lpBuffer=0x24577e4*, nNumberOfBytesToWrite=0x9ee0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x24577e4*, lpNumberOfBytesWritten=0x19eea0*=0x9ee0, lpOverlapped=0x0) returned 1 [0150.350] CloseHandle (hObject=0x34c) returned 1 [0150.353] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", lpFilePart=0x0) returned 0x32 [0150.353] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc.coom", lpFilePart=0x0) returned 0x37 [0150.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.353] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3whrrlh-2tuje8.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d86690, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0x4418c370, ftLastAccessTime.dwHighDateTime=0x1d826fb, ftLastWriteTime.dwLowDateTime=0x1e76dd67, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x9ee0)) returned 1 [0150.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.354] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3whrrlh-2tuje8.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3whrrlh-2tuje8.doc.coom")) returned 1 [0150.355] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", lpFilePart=0x0) returned 0x29 [0150.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.355] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5byo.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.355] GetFileType (hFile=0x34c) returned 0x1 [0150.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.355] GetFileType (hFile=0x34c) returned 0x1 [0150.355] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1751b [0150.356] ReadFile (in: hFile=0x34c, lpBuffer=0x3317520, nNumberOfBytesToRead=0x1751b, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3317520*, lpNumberOfBytesRead=0x19eeb0*=0x1751b, lpOverlapped=0x0) returned 1 [0150.357] CloseHandle (hObject=0x34c) returned 1 [0150.450] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", lpFilePart=0x0) returned 0x29 [0150.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.450] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5byo.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.453] GetFileType (hFile=0x34c) returned 0x1 [0150.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.453] GetFileType (hFile=0x34c) returned 0x1 [0150.453] WriteFile (in: hFile=0x34c, lpBuffer=0x338bef8*, nNumberOfBytesToWrite=0x17520, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x338bef8*, lpNumberOfBytesWritten=0x19eea0*=0x17520, lpOverlapped=0x0) returned 1 [0150.457] CloseHandle (hObject=0x34c) returned 1 [0150.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", lpFilePart=0x0) returned 0x29 [0150.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx.coom", lpFilePart=0x0) returned 0x2e [0150.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5byo.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f4c480, ftCreationTime.dwHighDateTime=0x1d8299f, ftLastAccessTime.dwLowDateTime=0xa3827650, ftLastAccessTime.dwHighDateTime=0x1d829e7, ftLastWriteTime.dwLowDateTime=0x1e87733f, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17520)) returned 1 [0150.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.462] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5byo.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5byo.pptx.coom")) returned 1 [0150.464] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", lpFilePart=0x0) returned 0x34 [0150.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.464] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6_8c7suq3sh2zdvr.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.465] GetFileType (hFile=0x34c) returned 0x1 [0150.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.465] GetFileType (hFile=0x34c) returned 0x1 [0150.465] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x4dca [0150.465] ReadFile (in: hFile=0x34c, lpBuffer=0x2229228, nNumberOfBytesToRead=0x4dca, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2229228*, lpNumberOfBytesRead=0x19eeb0*=0x4dca, lpOverlapped=0x0) returned 1 [0150.466] CloseHandle (hObject=0x34c) returned 1 [0150.487] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", lpFilePart=0x0) returned 0x34 [0150.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.487] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6_8c7suq3sh2zdvr.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.489] GetFileType (hFile=0x34c) returned 0x1 [0150.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.489] GetFileType (hFile=0x34c) returned 0x1 [0150.489] WriteFile (in: hFile=0x34c, lpBuffer=0x228e658*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x228e658*, lpNumberOfBytesWritten=0x19eea0*=0x4dd0, lpOverlapped=0x0) returned 1 [0150.491] CloseHandle (hObject=0x34c) returned 1 [0150.493] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", lpFilePart=0x0) returned 0x34 [0150.493] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt.coom", lpFilePart=0x0) returned 0x39 [0150.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6_8c7suq3sh2zdvr.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316d7680, ftCreationTime.dwHighDateTime=0x1d82066, ftLastAccessTime.dwLowDateTime=0x2ca42980, ftLastAccessTime.dwHighDateTime=0x1d82496, ftLastWriteTime.dwLowDateTime=0x1e8c2def, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x4dd0)) returned 1 [0150.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.493] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6_8c7suq3sh2zdvr.ppt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6_8c7suq3sh2zdvr.ppt.coom")) returned 1 [0150.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", lpFilePart=0x0) returned 0x38 [0150.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.494] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7avztg3coejywumxszt.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.494] GetFileType (hFile=0x34c) returned 0x1 [0150.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.495] GetFileType (hFile=0x34c) returned 0x1 [0150.495] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xaeac [0150.495] ReadFile (in: hFile=0x34c, lpBuffer=0x22937ec, nNumberOfBytesToRead=0xaeac, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22937ec*, lpNumberOfBytesRead=0x19eeb0*=0xaeac, lpOverlapped=0x0) returned 1 [0150.496] CloseHandle (hObject=0x34c) returned 1 [0150.517] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", lpFilePart=0x0) returned 0x38 [0150.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.517] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7avztg3coejywumxszt.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.519] GetFileType (hFile=0x34c) returned 0x1 [0150.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.519] GetFileType (hFile=0x34c) returned 0x1 [0150.519] WriteFile (in: hFile=0x34c, lpBuffer=0x23011d0*, nNumberOfBytesToWrite=0xaeb0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23011d0*, lpNumberOfBytesWritten=0x19eea0*=0xaeb0, lpOverlapped=0x0) returned 1 [0150.521] CloseHandle (hObject=0x34c) returned 1 [0150.525] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", lpFilePart=0x0) returned 0x38 [0150.525] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx.coom", lpFilePart=0x0) returned 0x3d [0150.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7avztg3coejywumxszt.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8970c0, ftCreationTime.dwHighDateTime=0x1d808ba, ftLastAccessTime.dwLowDateTime=0xd3c996e0, ftLastAccessTime.dwHighDateTime=0x1d80c5f, ftLastWriteTime.dwLowDateTime=0x1e91021d, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xaeb0)) returned 1 [0150.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.525] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7avztg3coejywumxszt.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7avztg3coejywumxszt.docx.coom")) returned 1 [0150.526] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", lpFilePart=0x0) returned 0x32 [0150.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.526] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\998wb55hd8qlh4.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.526] GetFileType (hFile=0x34c) returned 0x1 [0150.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.526] GetFileType (hFile=0x34c) returned 0x1 [0150.526] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xba63 [0150.526] ReadFile (in: hFile=0x34c, lpBuffer=0x230c454, nNumberOfBytesToRead=0xba63, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x230c454*, lpNumberOfBytesRead=0x19eeb0*=0xba63, lpOverlapped=0x0) returned 1 [0150.527] CloseHandle (hObject=0x34c) returned 1 [0150.550] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", lpFilePart=0x0) returned 0x32 [0150.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.550] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\998wb55hd8qlh4.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.551] GetFileType (hFile=0x34c) returned 0x1 [0150.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.551] GetFileType (hFile=0x34c) returned 0x1 [0150.551] WriteFile (in: hFile=0x34c, lpBuffer=0x237c17c*, nNumberOfBytesToWrite=0xba70, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x237c17c*, lpNumberOfBytesWritten=0x19eea0*=0xba70, lpOverlapped=0x0) returned 1 [0150.554] CloseHandle (hObject=0x34c) returned 1 [0150.557] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", lpFilePart=0x0) returned 0x32 [0150.557] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls.coom", lpFilePart=0x0) returned 0x37 [0150.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\998wb55hd8qlh4.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c31240, ftCreationTime.dwHighDateTime=0x1d81e5a, ftLastAccessTime.dwLowDateTime=0xc96b5a10, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0x1e95e879, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xba70)) returned 1 [0150.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.557] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\998wb55hd8qlh4.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\998wb55hd8qlh4.xls.coom")) returned 1 [0150.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", lpFilePart=0x0) returned 0x34 [0150.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.558] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a0kagtxvhzrgl2nu.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.558] GetFileType (hFile=0x34c) returned 0x1 [0150.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.558] GetFileType (hFile=0x34c) returned 0x1 [0150.558] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x17d16 [0150.558] ReadFile (in: hFile=0x34c, lpBuffer=0x33d0678, nNumberOfBytesToRead=0x17d16, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x33d0678*, lpNumberOfBytesRead=0x19eeb0*=0x17d16, lpOverlapped=0x0) returned 1 [0150.559] CloseHandle (hObject=0x34c) returned 1 [0150.585] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", lpFilePart=0x0) returned 0x34 [0150.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.586] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a0kagtxvhzrgl2nu.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.588] GetFileType (hFile=0x34c) returned 0x1 [0150.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.588] GetFileType (hFile=0x34c) returned 0x1 [0150.588] WriteFile (in: hFile=0x34c, lpBuffer=0x3447850*, nNumberOfBytesToWrite=0x17d20, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3447850*, lpNumberOfBytesWritten=0x19eea0*=0x17d20, lpOverlapped=0x0) returned 1 [0150.591] CloseHandle (hObject=0x34c) returned 1 [0150.595] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", lpFilePart=0x0) returned 0x34 [0150.595] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods.coom", lpFilePart=0x0) returned 0x39 [0150.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a0kagtxvhzrgl2nu.ods"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77eb4ff0, ftCreationTime.dwHighDateTime=0x1d81a22, ftLastAccessTime.dwLowDateTime=0xc802c340, ftLastAccessTime.dwHighDateTime=0x1d81f3d, ftLastWriteTime.dwLowDateTime=0x1e9bbf54, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17d20)) returned 1 [0150.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.596] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a0kagtxvhzrgl2nu.ods"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a0kagtxvhzrgl2nu.ods.coom")) returned 1 [0150.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", lpFilePart=0x0) returned 0x37 [0150.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.596] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ai3doif_i6aorcouoq.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.597] GetFileType (hFile=0x34c) returned 0x1 [0150.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.597] GetFileType (hFile=0x34c) returned 0x1 [0150.597] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xbdde [0150.597] ReadFile (in: hFile=0x34c, lpBuffer=0x23d5118, nNumberOfBytesToRead=0xbdde, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23d5118*, lpNumberOfBytesRead=0x19eeb0*=0xbdde, lpOverlapped=0x0) returned 1 [0150.599] CloseHandle (hObject=0x34c) returned 1 [0150.658] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", lpFilePart=0x0) returned 0x37 [0150.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.658] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ai3doif_i6aorcouoq.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.659] GetFileType (hFile=0x34c) returned 0x1 [0150.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.660] GetFileType (hFile=0x34c) returned 0x1 [0150.660] WriteFile (in: hFile=0x34c, lpBuffer=0x225167c*, nNumberOfBytesToWrite=0xbde0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x225167c*, lpNumberOfBytesWritten=0x19eea0*=0xbde0, lpOverlapped=0x0) returned 1 [0150.661] CloseHandle (hObject=0x34c) returned 1 [0150.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", lpFilePart=0x0) returned 0x37 [0150.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx.coom", lpFilePart=0x0) returned 0x3c [0150.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ai3doif_i6aorcouoq.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e388c50, ftCreationTime.dwHighDateTime=0x1d8230e, ftLastAccessTime.dwLowDateTime=0xb9f606f0, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0x1ea64158, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xbde0)) returned 1 [0150.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.664] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ai3doif_i6aorcouoq.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ai3doif_i6aorcouoq.docx.coom")) returned 1 [0150.665] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", lpFilePart=0x0) returned 0x35 [0150.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.665] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cj6k_ys9jtdntnd8.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.666] GetFileType (hFile=0x34c) returned 0x1 [0150.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.666] GetFileType (hFile=0x34c) returned 0x1 [0150.666] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x178c5 [0150.666] ReadFile (in: hFile=0x34c, lpBuffer=0x3477150, nNumberOfBytesToRead=0x178c5, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3477150*, lpNumberOfBytesRead=0x19eeb0*=0x178c5, lpOverlapped=0x0) returned 1 [0150.667] CloseHandle (hObject=0x34c) returned 1 [0150.698] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", lpFilePart=0x0) returned 0x35 [0150.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.698] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cj6k_ys9jtdntnd8.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.700] GetFileType (hFile=0x34c) returned 0x1 [0150.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.700] GetFileType (hFile=0x34c) returned 0x1 [0150.700] WriteFile (in: hFile=0x34c, lpBuffer=0x31e1e50*, nNumberOfBytesToWrite=0x178d0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x31e1e50*, lpNumberOfBytesWritten=0x19eea0*=0x178d0, lpOverlapped=0x0) returned 1 [0150.704] CloseHandle (hObject=0x34c) returned 1 [0150.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", lpFilePart=0x0) returned 0x35 [0150.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx.coom", lpFilePart=0x0) returned 0x3a [0150.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cj6k_ys9jtdntnd8.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f3e0b0, ftCreationTime.dwHighDateTime=0x1d82304, ftLastAccessTime.dwLowDateTime=0x92fdc3e0, ftLastAccessTime.dwHighDateTime=0x1d82779, ftLastWriteTime.dwLowDateTime=0x1ead0b8a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x178d0)) returned 1 [0150.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.709] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cj6k_ys9jtdntnd8.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cj6k_ys9jtdntnd8.xlsx.coom")) returned 1 [0150.709] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", lpFilePart=0x0) returned 0x37 [0150.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.709] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dkbw3ckgm uf2smdxz.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.710] GetFileType (hFile=0x34c) returned 0x1 [0150.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.710] GetFileType (hFile=0x34c) returned 0x1 [0150.710] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x15a24 [0150.710] ReadFile (in: hFile=0x34c, lpBuffer=0x31f9740, nNumberOfBytesToRead=0x15a24, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x31f9740*, lpNumberOfBytesRead=0x19eeb0*=0x15a24, lpOverlapped=0x0) returned 1 [0150.711] CloseHandle (hObject=0x34c) returned 1 [0150.771] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", lpFilePart=0x0) returned 0x37 [0150.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.772] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dkbw3ckgm uf2smdxz.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.773] GetFileType (hFile=0x34c) returned 0x1 [0150.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.774] GetFileType (hFile=0x34c) returned 0x1 [0150.774] WriteFile (in: hFile=0x34c, lpBuffer=0x3265a60*, nNumberOfBytesToWrite=0x15a30, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3265a60*, lpNumberOfBytesWritten=0x19eea0*=0x15a30, lpOverlapped=0x0) returned 1 [0150.776] CloseHandle (hObject=0x34c) returned 1 [0150.780] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", lpFilePart=0x0) returned 0x37 [0150.780] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx.coom", lpFilePart=0x0) returned 0x3c [0150.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dkbw3ckgm uf2smdxz.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650ad7f0, ftCreationTime.dwHighDateTime=0x1d7fad0, ftLastAccessTime.dwLowDateTime=0xa78efc20, ftLastAccessTime.dwHighDateTime=0x1d7fafb, ftLastWriteTime.dwLowDateTime=0x1eb8014e, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x15a30)) returned 1 [0150.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.781] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dkbw3ckgm uf2smdxz.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dkbw3ckgm uf2smdxz.pptx.coom")) returned 1 [0150.782] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", lpFilePart=0x0) returned 0x2d [0150.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.782] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dxzsj7_sq.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.783] GetFileType (hFile=0x34c) returned 0x1 [0150.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.783] GetFileType (hFile=0x34c) returned 0x1 [0150.783] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x184fc [0150.783] ReadFile (in: hFile=0x34c, lpBuffer=0x327b4b0, nNumberOfBytesToRead=0x184fc, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x327b4b0*, lpNumberOfBytesRead=0x19eeb0*=0x184fc, lpOverlapped=0x0) returned 1 [0150.784] CloseHandle (hObject=0x34c) returned 1 [0150.809] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", lpFilePart=0x0) returned 0x2d [0150.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.809] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dxzsj7_sq.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.811] GetFileType (hFile=0x34c) returned 0x1 [0150.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.812] GetFileType (hFile=0x34c) returned 0x1 [0150.812] WriteFile (in: hFile=0x34c, lpBuffer=0x32f4de8*, nNumberOfBytesToWrite=0x18500, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x32f4de8*, lpNumberOfBytesWritten=0x19eea0*=0x18500, lpOverlapped=0x0) returned 1 [0150.814] CloseHandle (hObject=0x34c) returned 1 [0150.818] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", lpFilePart=0x0) returned 0x2d [0150.818] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf.coom", lpFilePart=0x0) returned 0x32 [0150.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.818] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dxzsj7_sq.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b23a4f0, ftCreationTime.dwHighDateTime=0x1d82157, ftLastAccessTime.dwLowDateTime=0x1ca905c0, ftLastAccessTime.dwHighDateTime=0x1d82412, ftLastWriteTime.dwLowDateTime=0x1ebdbeef, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x18500)) returned 1 [0150.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.818] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dxzsj7_sq.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dxzsj7_sq.rtf.coom")) returned 1 [0150.834] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", lpFilePart=0x0) returned 0x31 [0150.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.834] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fgtsnob7ndvo.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.835] GetFileType (hFile=0x34c) returned 0x1 [0150.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.835] GetFileType (hFile=0x34c) returned 0x1 [0150.835] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x3aa2 [0150.835] ReadFile (in: hFile=0x34c, lpBuffer=0x2273bf4, nNumberOfBytesToRead=0x3aa2, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2273bf4*, lpNumberOfBytesRead=0x19eeb0*=0x3aa2, lpOverlapped=0x0) returned 1 [0150.835] CloseHandle (hObject=0x34c) returned 1 [0150.866] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", lpFilePart=0x0) returned 0x31 [0150.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.866] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fgtsnob7ndvo.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.869] GetFileType (hFile=0x34c) returned 0x1 [0150.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.869] GetFileType (hFile=0x34c) returned 0x1 [0150.869] WriteFile (in: hFile=0x34c, lpBuffer=0x22d2f28*, nNumberOfBytesToWrite=0x3ab0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22d2f28*, lpNumberOfBytesWritten=0x19eea0*=0x3ab0, lpOverlapped=0x0) returned 1 [0150.873] CloseHandle (hObject=0x34c) returned 1 [0150.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", lpFilePart=0x0) returned 0x31 [0150.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx.coom", lpFilePart=0x0) returned 0x36 [0150.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fgtsnob7ndvo.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaafcff60, ftCreationTime.dwHighDateTime=0x1d79da9, ftLastAccessTime.dwLowDateTime=0x28a85380, ftLastAccessTime.dwHighDateTime=0x1d7d8d6, ftLastWriteTime.dwLowDateTime=0x1ec6812c, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x3ab0)) returned 1 [0150.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.876] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fgtsnob7ndvo.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fgtsnob7ndvo.xlsx.coom")) returned 1 [0150.876] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", lpFilePart=0x0) returned 0x31 [0150.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fie7zb85t8b-.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.877] GetFileType (hFile=0x34c) returned 0x1 [0150.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.877] GetFileType (hFile=0x34c) returned 0x1 [0150.877] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x18249 [0150.877] ReadFile (in: hFile=0x34c, lpBuffer=0x330d308, nNumberOfBytesToRead=0x18249, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x330d308*, lpNumberOfBytesRead=0x19eeb0*=0x18249, lpOverlapped=0x0) returned 1 [0150.879] CloseHandle (hObject=0x34c) returned 1 [0150.914] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", lpFilePart=0x0) returned 0x31 [0150.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0150.914] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fie7zb85t8b-.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.917] GetFileType (hFile=0x34c) returned 0x1 [0150.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0150.917] GetFileType (hFile=0x34c) returned 0x1 [0150.917] WriteFile (in: hFile=0x34c, lpBuffer=0x3385ed0*, nNumberOfBytesToWrite=0x18250, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3385ed0*, lpNumberOfBytesWritten=0x19eea0*=0x18250, lpOverlapped=0x0) returned 1 [0150.927] CloseHandle (hObject=0x34c) returned 1 [0150.932] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", lpFilePart=0x0) returned 0x31 [0150.932] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx.coom", lpFilePart=0x0) returned 0x36 [0150.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0150.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fie7zb85t8b-.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeafe250, ftCreationTime.dwHighDateTime=0x1d7fd14, ftLastAccessTime.dwLowDateTime=0xbc177e80, ftLastAccessTime.dwHighDateTime=0x1d81e21, ftLastWriteTime.dwLowDateTime=0x1ecf1be9, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x18250)) returned 1 [0150.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0150.932] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fie7zb85t8b-.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fie7zb85t8b-.pptx.coom")) returned 1 [0150.933] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", lpFilePart=0x0) returned 0x33 [0150.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0150.933] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fxtu7tjgkarcut.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0150.944] GetFileType (hFile=0x34c) returned 0x1 [0150.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0150.944] GetFileType (hFile=0x34c) returned 0x1 [0150.944] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x14e20 [0150.944] ReadFile (in: hFile=0x34c, lpBuffer=0x339e140, nNumberOfBytesToRead=0x14e20, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x339e140*, lpNumberOfBytesRead=0x19eeb0*=0x14e20, lpOverlapped=0x0) returned 1 [0150.946] CloseHandle (hObject=0x34c) returned 1 [0151.049] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", lpFilePart=0x0) returned 0x33 [0151.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.050] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fxtu7tjgkarcut.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.052] GetFileType (hFile=0x34c) returned 0x1 [0151.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.052] GetFileType (hFile=0x34c) returned 0x1 [0151.052] WriteFile (in: hFile=0x34c, lpBuffer=0x3406860*, nNumberOfBytesToWrite=0x14e30, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3406860*, lpNumberOfBytesWritten=0x19eea0*=0x14e30, lpOverlapped=0x0) returned 1 [0151.056] CloseHandle (hObject=0x34c) returned 1 [0151.070] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", lpFilePart=0x0) returned 0x33 [0151.070] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx.coom", lpFilePart=0x0) returned 0x38 [0151.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.070] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fxtu7tjgkarcut.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb79abd10, ftCreationTime.dwHighDateTime=0x1d8209f, ftLastAccessTime.dwLowDateTime=0x2f5d36e0, ftLastAccessTime.dwHighDateTime=0x1d82837, ftLastWriteTime.dwLowDateTime=0x1ee43bc6, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x14e30)) returned 1 [0151.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.070] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fxtu7tjgkarcut.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fxtu7tjgkarcut.pptx.coom")) returned 1 [0151.072] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", lpFilePart=0x0) returned 0x28 [0151.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.073] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gxt7.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.073] GetFileType (hFile=0x34c) returned 0x1 [0151.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.073] GetFileType (hFile=0x34c) returned 0x1 [0151.073] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x5c48 [0151.073] ReadFile (in: hFile=0x34c, lpBuffer=0x2371000, nNumberOfBytesToRead=0x5c48, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2371000*, lpNumberOfBytesRead=0x19eeb0*=0x5c48, lpOverlapped=0x0) returned 1 [0151.074] CloseHandle (hObject=0x34c) returned 1 [0151.100] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", lpFilePart=0x0) returned 0x28 [0151.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.100] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gxt7.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.102] GetFileType (hFile=0x34c) returned 0x1 [0151.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.102] GetFileType (hFile=0x34c) returned 0x1 [0151.102] WriteFile (in: hFile=0x34c, lpBuffer=0x21e4e64*, nNumberOfBytesToWrite=0x5c50, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x21e4e64*, lpNumberOfBytesWritten=0x19eea0*=0x5c50, lpOverlapped=0x0) returned 1 [0151.104] CloseHandle (hObject=0x34c) returned 1 [0151.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", lpFilePart=0x0) returned 0x28 [0151.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf.coom", lpFilePart=0x0) returned 0x2d [0151.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.107] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gxt7.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a84d640, ftCreationTime.dwHighDateTime=0x1d81dbc, ftLastAccessTime.dwLowDateTime=0x5c6943a0, ftLastAccessTime.dwHighDateTime=0x1d826dd, ftLastWriteTime.dwLowDateTime=0x1ee9dd91, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x5c50)) returned 1 [0151.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.107] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gxt7.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gxt7.rtf.coom")) returned 1 [0151.108] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", lpFilePart=0x0) returned 0x34 [0151.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.108] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\h8t-rsy oy1wsabm.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.109] GetFileType (hFile=0x34c) returned 0x1 [0151.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.109] GetFileType (hFile=0x34c) returned 0x1 [0151.109] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1443f [0151.109] ReadFile (in: hFile=0x34c, lpBuffer=0x21eadf0, nNumberOfBytesToRead=0x1443f, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x21eadf0*, lpNumberOfBytesRead=0x19eeb0*=0x1443f, lpOverlapped=0x0) returned 1 [0151.110] CloseHandle (hObject=0x34c) returned 1 [0151.198] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", lpFilePart=0x0) returned 0x34 [0151.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.198] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\h8t-rsy oy1wsabm.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.203] GetFileType (hFile=0x34c) returned 0x1 [0151.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.203] GetFileType (hFile=0x34c) returned 0x1 [0151.203] WriteFile (in: hFile=0x34c, lpBuffer=0x22749e4*, nNumberOfBytesToWrite=0x14440, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22749e4*, lpNumberOfBytesWritten=0x19eea0*=0x14440, lpOverlapped=0x0) returned 1 [0151.207] CloseHandle (hObject=0x34c) returned 1 [0151.211] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", lpFilePart=0x0) returned 0x34 [0151.211] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv.coom", lpFilePart=0x0) returned 0x39 [0151.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.211] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\h8t-rsy oy1wsabm.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fdf1610, ftCreationTime.dwHighDateTime=0x1d81eff, ftLastAccessTime.dwLowDateTime=0x7ae89d30, ftLastAccessTime.dwHighDateTime=0x1d8207f, ftLastWriteTime.dwLowDateTime=0x1ef9c704, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x14440)) returned 1 [0151.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.212] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\h8t-rsy oy1wsabm.csv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\h8t-rsy oy1wsabm.csv.coom")) returned 1 [0151.213] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", lpFilePart=0x0) returned 0x29 [0151.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.213] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hgaku.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.213] GetFileType (hFile=0x34c) returned 0x1 [0151.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.214] GetFileType (hFile=0x34c) returned 0x1 [0151.214] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xf2bd [0151.214] ReadFile (in: hFile=0x34c, lpBuffer=0x22891a8, nNumberOfBytesToRead=0xf2bd, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22891a8*, lpNumberOfBytesRead=0x19eeb0*=0xf2bd, lpOverlapped=0x0) returned 1 [0151.215] CloseHandle (hObject=0x34c) returned 1 [0151.247] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", lpFilePart=0x0) returned 0x29 [0151.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.247] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hgaku.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.249] GetFileType (hFile=0x34c) returned 0x1 [0151.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.250] GetFileType (hFile=0x34c) returned 0x1 [0151.250] WriteFile (in: hFile=0x34c, lpBuffer=0x23037c0*, nNumberOfBytesToWrite=0xf2c0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23037c0*, lpNumberOfBytesWritten=0x19eea0*=0xf2c0, lpOverlapped=0x0) returned 1 [0151.253] CloseHandle (hObject=0x34c) returned 1 [0151.256] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", lpFilePart=0x0) returned 0x29 [0151.256] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt.coom", lpFilePart=0x0) returned 0x2e [0151.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.257] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hgaku.odt"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899e2e40, ftCreationTime.dwHighDateTime=0x1d81cf5, ftLastAccessTime.dwLowDateTime=0x5d7c3b20, ftLastAccessTime.dwHighDateTime=0x1d81e96, ftLastWriteTime.dwLowDateTime=0x1f00a999, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xf2c0)) returned 1 [0151.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.257] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hgaku.odt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hgaku.odt.coom")) returned 1 [0151.258] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", lpFilePart=0x0) returned 0x29 [0151.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.258] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\irih.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.258] GetFileType (hFile=0x34c) returned 0x1 [0151.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.258] GetFileType (hFile=0x34c) returned 0x1 [0151.258] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xef62 [0151.258] ReadFile (in: hFile=0x34c, lpBuffer=0x2312d94, nNumberOfBytesToRead=0xef62, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2312d94*, lpNumberOfBytesRead=0x19eeb0*=0xef62, lpOverlapped=0x0) returned 1 [0151.260] CloseHandle (hObject=0x34c) returned 1 [0151.310] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", lpFilePart=0x0) returned 0x29 [0151.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.310] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\irih.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.312] GetFileType (hFile=0x34c) returned 0x1 [0151.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.312] GetFileType (hFile=0x34c) returned 0x1 [0151.312] WriteFile (in: hFile=0x34c, lpBuffer=0x238c9bc*, nNumberOfBytesToWrite=0xef70, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x238c9bc*, lpNumberOfBytesWritten=0x19eea0*=0xef70, lpOverlapped=0x0) returned 1 [0151.315] CloseHandle (hObject=0x34c) returned 1 [0151.319] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", lpFilePart=0x0) returned 0x29 [0151.319] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx.coom", lpFilePart=0x0) returned 0x2e [0151.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.319] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\irih.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f402890, ftCreationTime.dwHighDateTime=0x1d7ba24, ftLastAccessTime.dwLowDateTime=0x7255a3c0, ftLastAccessTime.dwHighDateTime=0x1d7ea74, ftLastWriteTime.dwLowDateTime=0x1f0a363c, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xef70)) returned 1 [0151.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.319] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\irih.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\irih.docx.coom")) returned 1 [0151.320] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", lpFilePart=0x0) returned 0x35 [0151.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.320] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\isv2cxax0so0nwq3.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.321] GetFileType (hFile=0x34c) returned 0x1 [0151.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.321] GetFileType (hFile=0x34c) returned 0x1 [0151.321] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x454b [0151.321] ReadFile (in: hFile=0x34c, lpBuffer=0x239bc70, nNumberOfBytesToRead=0x454b, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x239bc70*, lpNumberOfBytesRead=0x19eeb0*=0x454b, lpOverlapped=0x0) returned 1 [0151.321] CloseHandle (hObject=0x34c) returned 1 [0151.404] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", lpFilePart=0x0) returned 0x35 [0151.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.404] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\isv2cxax0so0nwq3.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.406] GetFileType (hFile=0x34c) returned 0x1 [0151.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.406] GetFileType (hFile=0x34c) returned 0x1 [0151.406] WriteFile (in: hFile=0x34c, lpBuffer=0x2202db4*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2202db4*, lpNumberOfBytesWritten=0x19eea0*=0x4550, lpOverlapped=0x0) returned 1 [0151.408] CloseHandle (hObject=0x34c) returned 1 [0151.410] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", lpFilePart=0x0) returned 0x35 [0151.410] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx.coom", lpFilePart=0x0) returned 0x3a [0151.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.410] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\isv2cxax0so0nwq3.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee2c490, ftCreationTime.dwHighDateTime=0x1d81b1c, ftLastAccessTime.dwLowDateTime=0x3c989e80, ftLastAccessTime.dwHighDateTime=0x1d81fe0, ftLastWriteTime.dwLowDateTime=0x1f18280a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x4550)) returned 1 [0151.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.411] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\isv2cxax0so0nwq3.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\isv2cxax0so0nwq3.docx.coom")) returned 1 [0151.412] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", lpFilePart=0x0) returned 0x29 [0151.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.412] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxam.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.412] GetFileType (hFile=0x34c) returned 0x1 [0151.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.412] GetFileType (hFile=0x34c) returned 0x1 [0151.412] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x7e53 [0151.412] ReadFile (in: hFile=0x34c, lpBuffer=0x2207690, nNumberOfBytesToRead=0x7e53, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2207690*, lpNumberOfBytesRead=0x19eeb0*=0x7e53, lpOverlapped=0x0) returned 1 [0151.413] CloseHandle (hObject=0x34c) returned 1 [0151.448] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", lpFilePart=0x0) returned 0x29 [0151.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.448] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxam.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.450] GetFileType (hFile=0x34c) returned 0x1 [0151.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.450] GetFileType (hFile=0x34c) returned 0x1 [0151.451] WriteFile (in: hFile=0x34c, lpBuffer=0x227bd90*, nNumberOfBytesToWrite=0x7e60, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x227bd90*, lpNumberOfBytesWritten=0x19eea0*=0x7e60, lpOverlapped=0x0) returned 1 [0151.452] CloseHandle (hObject=0x34c) returned 1 [0151.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", lpFilePart=0x0) returned 0x29 [0151.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx.coom", lpFilePart=0x0) returned 0x2e [0151.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.455] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxam.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf5fa0, ftCreationTime.dwHighDateTime=0x1d824fe, ftLastAccessTime.dwLowDateTime=0x2639b3f0, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0x1f1ee629, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7e60)) returned 1 [0151.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.455] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxam.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxam.xlsx.coom")) returned 1 [0151.456] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", lpFilePart=0x0) returned 0x37 [0151.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.456] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxf5o1une8gz7vpn-x.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.457] GetFileType (hFile=0x34c) returned 0x1 [0151.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.457] GetFileType (hFile=0x34c) returned 0x1 [0151.457] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xd8e0 [0151.457] ReadFile (in: hFile=0x34c, lpBuffer=0x2283f3c, nNumberOfBytesToRead=0xd8e0, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2283f3c*, lpNumberOfBytesRead=0x19eeb0*=0xd8e0, lpOverlapped=0x0) returned 1 [0151.461] CloseHandle (hObject=0x34c) returned 1 [0151.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", lpFilePart=0x0) returned 0x37 [0151.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.492] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxf5o1une8gz7vpn-x.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.495] GetFileType (hFile=0x34c) returned 0x1 [0151.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.495] GetFileType (hFile=0x34c) returned 0x1 [0151.495] WriteFile (in: hFile=0x34c, lpBuffer=0x22f97e0*, nNumberOfBytesToWrite=0xd8f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22f97e0*, lpNumberOfBytesWritten=0x19eea0*=0xd8f0, lpOverlapped=0x0) returned 1 [0151.501] CloseHandle (hObject=0x34c) returned 1 [0151.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", lpFilePart=0x0) returned 0x37 [0151.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx.coom", lpFilePart=0x0) returned 0x3c [0151.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxf5o1une8gz7vpn-x.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927389f0, ftCreationTime.dwHighDateTime=0x1d7a9b1, ftLastAccessTime.dwLowDateTime=0x6cd7edd0, ftLastAccessTime.dwHighDateTime=0x1d7eb15, ftLastWriteTime.dwLowDateTime=0x1f26641a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xd8f0)) returned 1 [0151.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.504] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxf5o1une8gz7vpn-x.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxf5o1une8gz7vpn-x.docx.coom")) returned 1 [0151.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", lpFilePart=0x0) returned 0x32 [0151.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.505] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxh6pbyu5lgk0.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.505] GetFileType (hFile=0x34c) returned 0x1 [0151.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.506] GetFileType (hFile=0x34c) returned 0x1 [0151.506] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x6776 [0151.506] ReadFile (in: hFile=0x34c, lpBuffer=0x2307498, nNumberOfBytesToRead=0x6776, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2307498*, lpNumberOfBytesRead=0x19eeb0*=0x6776, lpOverlapped=0x0) returned 1 [0151.508] CloseHandle (hObject=0x34c) returned 1 [0151.537] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", lpFilePart=0x0) returned 0x32 [0151.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.537] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxh6pbyu5lgk0.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.547] GetFileType (hFile=0x34c) returned 0x1 [0151.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.548] GetFileType (hFile=0x34c) returned 0x1 [0151.548] WriteFile (in: hFile=0x34c, lpBuffer=0x23747dc*, nNumberOfBytesToWrite=0x6780, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23747dc*, lpNumberOfBytesWritten=0x19eea0*=0x6780, lpOverlapped=0x0) returned 1 [0151.550] CloseHandle (hObject=0x34c) returned 1 [0151.553] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", lpFilePart=0x0) returned 0x32 [0151.553] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx.coom", lpFilePart=0x0) returned 0x37 [0151.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.553] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxh6pbyu5lgk0.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4f2f040, ftCreationTime.dwHighDateTime=0x1d7feac, ftLastAccessTime.dwLowDateTime=0x4744cb10, ftLastAccessTime.dwHighDateTime=0x1d82774, ftLastWriteTime.dwLowDateTime=0x1f2de144, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x6780)) returned 1 [0151.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.553] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxh6pbyu5lgk0.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxh6pbyu5lgk0.pptx.coom")) returned 1 [0151.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", lpFilePart=0x0) returned 0x30 [0151.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.554] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lyrryp d-2z.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.555] GetFileType (hFile=0x34c) returned 0x1 [0151.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.555] GetFileType (hFile=0x34c) returned 0x1 [0151.555] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x107a9 [0151.555] ReadFile (in: hFile=0x34c, lpBuffer=0x237b2ec, nNumberOfBytesToRead=0x107a9, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x237b2ec*, lpNumberOfBytesRead=0x19eeb0*=0x107a9, lpOverlapped=0x0) returned 1 [0151.557] CloseHandle (hObject=0x34c) returned 1 [0151.597] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", lpFilePart=0x0) returned 0x30 [0151.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.597] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lyrryp d-2z.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.599] GetFileType (hFile=0x34c) returned 0x1 [0151.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.599] GetFileType (hFile=0x34c) returned 0x1 [0151.599] WriteFile (in: hFile=0x34c, lpBuffer=0x2223eb0*, nNumberOfBytesToWrite=0x107b0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2223eb0*, lpNumberOfBytesWritten=0x19eea0*=0x107b0, lpOverlapped=0x0) returned 1 [0151.603] CloseHandle (hObject=0x34c) returned 1 [0151.607] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", lpFilePart=0x0) returned 0x30 [0151.608] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx.coom", lpFilePart=0x0) returned 0x35 [0151.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lyrryp d-2z.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eb80d0, ftCreationTime.dwHighDateTime=0x1d82436, ftLastAccessTime.dwLowDateTime=0x25fb4ab0, ftLastAccessTime.dwHighDateTime=0x1d825df, ftLastWriteTime.dwLowDateTime=0x1f36434b, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x107b0)) returned 1 [0151.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.608] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lyrryp d-2z.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lyrryp d-2z.docx.coom")) returned 1 [0151.609] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", lpFilePart=0x0) returned 0x37 [0151.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.609] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\msnffswckp fbcieui5.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.610] GetFileType (hFile=0x34c) returned 0x1 [0151.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.610] GetFileType (hFile=0x34c) returned 0x1 [0151.610] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x13bb0 [0151.610] ReadFile (in: hFile=0x34c, lpBuffer=0x22349f4, nNumberOfBytesToRead=0x13bb0, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22349f4*, lpNumberOfBytesRead=0x19eeb0*=0x13bb0, lpOverlapped=0x0) returned 1 [0151.611] CloseHandle (hObject=0x34c) returned 1 [0151.693] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", lpFilePart=0x0) returned 0x37 [0151.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.694] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\msnffswckp fbcieui5.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.696] GetFileType (hFile=0x34c) returned 0x1 [0151.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.696] GetFileType (hFile=0x34c) returned 0x1 [0151.696] WriteFile (in: hFile=0x34c, lpBuffer=0x22bcc64*, nNumberOfBytesToWrite=0x13bc0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22bcc64*, lpNumberOfBytesWritten=0x19eea0*=0x13bc0, lpOverlapped=0x0) returned 1 [0151.699] CloseHandle (hObject=0x34c) returned 1 [0151.703] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", lpFilePart=0x0) returned 0x37 [0151.704] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc.coom", lpFilePart=0x0) returned 0x3c [0151.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.704] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\msnffswckp fbcieui5.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02879f0, ftCreationTime.dwHighDateTime=0x1d826fb, ftLastAccessTime.dwLowDateTime=0xc3865040, ftLastAccessTime.dwHighDateTime=0x1d827ab, ftLastWriteTime.dwLowDateTime=0x1f44df65, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13bc0)) returned 1 [0151.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.705] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\msnffswckp fbcieui5.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\msnffswckp fbcieui5.doc.coom")) returned 1 [0151.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", lpFilePart=0x0) returned 0x2c [0151.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.706] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n7hkhiqs.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.706] GetFileType (hFile=0x34c) returned 0x1 [0151.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.707] GetFileType (hFile=0x34c) returned 0x1 [0151.707] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x3e19 [0151.707] ReadFile (in: hFile=0x34c, lpBuffer=0x22d0bd4, nNumberOfBytesToRead=0x3e19, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22d0bd4*, lpNumberOfBytesRead=0x19eeb0*=0x3e19, lpOverlapped=0x0) returned 1 [0151.707] CloseHandle (hObject=0x34c) returned 1 [0151.734] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", lpFilePart=0x0) returned 0x2c [0151.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.735] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n7hkhiqs.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.737] GetFileType (hFile=0x34c) returned 0x1 [0151.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.737] GetFileType (hFile=0x34c) returned 0x1 [0151.737] WriteFile (in: hFile=0x34c, lpBuffer=0x2331038*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2331038*, lpNumberOfBytesWritten=0x19eea0*=0x3e20, lpOverlapped=0x0) returned 1 [0151.739] CloseHandle (hObject=0x34c) returned 1 [0151.741] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", lpFilePart=0x0) returned 0x2c [0151.741] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf.coom", lpFilePart=0x0) returned 0x31 [0151.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n7hkhiqs.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe55e5d0, ftCreationTime.dwHighDateTime=0x1d81cad, ftLastAccessTime.dwLowDateTime=0xb079e420, ftLastAccessTime.dwHighDateTime=0x1d824d2, ftLastWriteTime.dwLowDateTime=0x1f4a9026, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x3e20)) returned 1 [0151.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.745] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n7hkhiqs.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n7hkhiqs.rtf.coom")) returned 1 [0151.746] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", lpFilePart=0x0) returned 0x34 [0151.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.746] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ocgatxc-6ez0hk_y.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.746] GetFileType (hFile=0x34c) returned 0x1 [0151.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.746] GetFileType (hFile=0x34c) returned 0x1 [0151.746] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xf85f [0151.746] ReadFile (in: hFile=0x34c, lpBuffer=0x23351bc, nNumberOfBytesToRead=0xf85f, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23351bc*, lpNumberOfBytesRead=0x19eeb0*=0xf85f, lpOverlapped=0x0) returned 1 [0151.747] CloseHandle (hObject=0x34c) returned 1 [0151.795] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", lpFilePart=0x0) returned 0x34 [0151.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.796] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ocgatxc-6ez0hk_y.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.798] GetFileType (hFile=0x34c) returned 0x1 [0151.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.798] GetFileType (hFile=0x34c) returned 0x1 [0151.798] WriteFile (in: hFile=0x34c, lpBuffer=0x21e9008*, nNumberOfBytesToWrite=0xf860, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x21e9008*, lpNumberOfBytesWritten=0x19eea0*=0xf860, lpOverlapped=0x0) returned 1 [0151.801] CloseHandle (hObject=0x34c) returned 1 [0151.805] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", lpFilePart=0x0) returned 0x34 [0151.805] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls.coom", lpFilePart=0x0) returned 0x39 [0151.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.805] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ocgatxc-6ez0hk_y.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc50c0, ftCreationTime.dwHighDateTime=0x1d819fd, ftLastAccessTime.dwLowDateTime=0x5f903f90, ftLastAccessTime.dwHighDateTime=0x1d81b8c, ftLastWriteTime.dwLowDateTime=0x1f545aaf, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xf860)) returned 1 [0151.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.805] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ocgatxc-6ez0hk_y.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ocgatxc-6ez0hk_y.xls.coom")) returned 1 [0151.807] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", lpFilePart=0x0) returned 0x31 [0151.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.807] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\owf5pa qzmhbd.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.807] GetFileType (hFile=0x34c) returned 0x1 [0151.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.807] GetFileType (hFile=0x34c) returned 0x1 [0151.807] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xa3ee [0151.808] ReadFile (in: hFile=0x34c, lpBuffer=0x21f8c0c, nNumberOfBytesToRead=0xa3ee, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x21f8c0c*, lpNumberOfBytesRead=0x19eeb0*=0xa3ee, lpOverlapped=0x0) returned 1 [0151.808] CloseHandle (hObject=0x34c) returned 1 [0151.876] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", lpFilePart=0x0) returned 0x31 [0151.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.876] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\owf5pa qzmhbd.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.878] GetFileType (hFile=0x34c) returned 0x1 [0151.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.878] GetFileType (hFile=0x34c) returned 0x1 [0151.878] WriteFile (in: hFile=0x34c, lpBuffer=0x2278edc*, nNumberOfBytesToWrite=0xa3f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2278edc*, lpNumberOfBytesWritten=0x19eea0*=0xa3f0, lpOverlapped=0x0) returned 1 [0151.880] CloseHandle (hObject=0x34c) returned 1 [0151.883] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", lpFilePart=0x0) returned 0x31 [0151.883] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf.coom", lpFilePart=0x0) returned 0x36 [0151.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0151.883] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\owf5pa qzmhbd.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f827a60, ftCreationTime.dwHighDateTime=0x1d81dca, ftLastAccessTime.dwLowDateTime=0x59dd3ca0, ftLastAccessTime.dwHighDateTime=0x1d823df, ftLastWriteTime.dwLowDateTime=0x1f603d67, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xa3f0)) returned 1 [0151.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0151.883] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\owf5pa qzmhbd.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\owf5pa qzmhbd.rtf.coom")) returned 1 [0151.886] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", lpFilePart=0x0) returned 0x36 [0151.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0151.887] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\p9ul--trl_6unnwprc.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.887] GetFileType (hFile=0x34c) returned 0x1 [0151.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0151.887] GetFileType (hFile=0x34c) returned 0x1 [0151.887] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x4953 [0151.887] ReadFile (in: hFile=0x34c, lpBuffer=0x2283668, nNumberOfBytesToRead=0x4953, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2283668*, lpNumberOfBytesRead=0x19eeb0*=0x4953, lpOverlapped=0x0) returned 1 [0151.888] CloseHandle (hObject=0x34c) returned 1 [0151.911] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", lpFilePart=0x0) returned 0x36 [0151.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0151.912] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\p9ul--trl_6unnwprc.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0151.914] GetFileType (hFile=0x34c) returned 0x1 [0151.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0151.914] GetFileType (hFile=0x34c) returned 0x1 [0151.914] WriteFile (in: hFile=0x34c, lpBuffer=0x22e730c*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22e730c*, lpNumberOfBytesWritten=0x19eea0*=0x4960, lpOverlapped=0x0) returned 1 [0151.916] CloseHandle (hObject=0x34c) returned 1 [0152.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", lpFilePart=0x0) returned 0x36 [0152.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt.coom", lpFilePart=0x0) returned 0x3b [0152.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\p9ul--trl_6unnwprc.odt"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc572d180, ftCreationTime.dwHighDateTime=0x1d8296d, ftLastAccessTime.dwLowDateTime=0x9b0dd40, ftLastAccessTime.dwHighDateTime=0x1d829f2, ftLastWriteTime.dwLowDateTime=0x1f882768, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x4960)) returned 1 [0152.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.145] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\p9ul--trl_6unnwprc.odt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\p9ul--trl_6unnwprc.odt.coom")) returned 1 [0152.146] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", lpFilePart=0x0) returned 0x38 [0152.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.146] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\psjlpn8drurz1-xy6fw_.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.147] GetFileType (hFile=0x34c) returned 0x1 [0152.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.147] GetFileType (hFile=0x34c) returned 0x1 [0152.147] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x12344 [0152.147] ReadFile (in: hFile=0x34c, lpBuffer=0x22ec044, nNumberOfBytesToRead=0x12344, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22ec044*, lpNumberOfBytesRead=0x19eeb0*=0x12344, lpOverlapped=0x0) returned 1 [0152.148] CloseHandle (hObject=0x34c) returned 1 [0152.179] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", lpFilePart=0x0) returned 0x38 [0152.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.179] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\psjlpn8drurz1-xy6fw_.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.183] GetFileType (hFile=0x34c) returned 0x1 [0152.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.184] GetFileType (hFile=0x34c) returned 0x1 [0152.184] WriteFile (in: hFile=0x34c, lpBuffer=0x236f808*, nNumberOfBytesToWrite=0x12350, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x236f808*, lpNumberOfBytesWritten=0x19eea0*=0x12350, lpOverlapped=0x0) returned 1 [0152.187] CloseHandle (hObject=0x34c) returned 1 [0152.191] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", lpFilePart=0x0) returned 0x38 [0152.192] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf.coom", lpFilePart=0x0) returned 0x3d [0152.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.192] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\psjlpn8drurz1-xy6fw_.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc60980, ftCreationTime.dwHighDateTime=0x1d829a0, ftLastAccessTime.dwLowDateTime=0xa1794260, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0x1f8f599a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x12350)) returned 1 [0152.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.192] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\psjlpn8drurz1-xy6fw_.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\psjlpn8drurz1-xy6fw_.pdf.coom")) returned 1 [0152.193] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", lpFilePart=0x0) returned 0x32 [0152.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.193] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\q9j2c2vhqgqt8y.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.194] GetFileType (hFile=0x34c) returned 0x1 [0152.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.194] GetFileType (hFile=0x34c) returned 0x1 [0152.194] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x10b71 [0152.194] ReadFile (in: hFile=0x34c, lpBuffer=0x2381f2c, nNumberOfBytesToRead=0x10b71, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2381f2c*, lpNumberOfBytesRead=0x19eeb0*=0x10b71, lpOverlapped=0x0) returned 1 [0152.195] CloseHandle (hObject=0x34c) returned 1 [0152.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", lpFilePart=0x0) returned 0x32 [0152.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.227] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\q9j2c2vhqgqt8y.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.229] GetFileType (hFile=0x34c) returned 0x1 [0152.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.229] GetFileType (hFile=0x34c) returned 0x1 [0152.229] WriteFile (in: hFile=0x34c, lpBuffer=0x2400f84*, nNumberOfBytesToWrite=0x10b80, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2400f84*, lpNumberOfBytesWritten=0x19eea0*=0x10b80, lpOverlapped=0x0) returned 1 [0152.232] CloseHandle (hObject=0x34c) returned 1 [0152.235] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", lpFilePart=0x0) returned 0x32 [0152.235] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls.coom", lpFilePart=0x0) returned 0x37 [0152.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.235] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\q9j2c2vhqgqt8y.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6810580, ftCreationTime.dwHighDateTime=0x1d819e3, ftLastAccessTime.dwLowDateTime=0x3c8de40, ftLastAccessTime.dwHighDateTime=0x1d81ed6, ftLastWriteTime.dwLowDateTime=0x1f95f720, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x10b80)) returned 1 [0152.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.235] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\q9j2c2vhqgqt8y.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\q9j2c2vhqgqt8y.xls.coom")) returned 1 [0152.239] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", lpFilePart=0x0) returned 0x39 [0152.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.239] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qi06dg7isl hmonv94db.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.240] GetFileType (hFile=0x34c) returned 0x1 [0152.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.240] GetFileType (hFile=0x34c) returned 0x1 [0152.240] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1160 [0152.240] ReadFile (in: hFile=0x34c, lpBuffer=0x2411eb4, nNumberOfBytesToRead=0x1160, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2411eb4*, lpNumberOfBytesRead=0x19eeb0*=0x1160, lpOverlapped=0x0) returned 1 [0152.240] CloseHandle (hObject=0x34c) returned 1 [0152.319] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", lpFilePart=0x0) returned 0x39 [0152.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.320] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qi06dg7isl hmonv94db.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.321] GetFileType (hFile=0x34c) returned 0x1 [0152.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.321] GetFileType (hFile=0x34c) returned 0x1 [0152.321] WriteFile (in: hFile=0x34c, lpBuffer=0x24643a4*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x24643a4*, lpNumberOfBytesWritten=0x19eea0*=0x1170, lpOverlapped=0x0) returned 1 [0152.322] CloseHandle (hObject=0x34c) returned 1 [0152.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", lpFilePart=0x0) returned 0x39 [0152.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx.coom", lpFilePart=0x0) returned 0x3e [0152.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qi06dg7isl hmonv94db.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8100020, ftCreationTime.dwHighDateTime=0x1d81323, ftLastAccessTime.dwLowDateTime=0x5835a220, ftLastAccessTime.dwHighDateTime=0x1d821a5, ftLastWriteTime.dwLowDateTime=0x1fa380f7, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x1170)) returned 1 [0152.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.324] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qi06dg7isl hmonv94db.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qi06dg7isl hmonv94db.xlsx.coom")) returned 1 [0152.325] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", lpFilePart=0x0) returned 0x38 [0152.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.325] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qqwlqdbqrfvam vqx4dg.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.325] GetFileType (hFile=0x34c) returned 0x1 [0152.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.325] GetFileType (hFile=0x34c) returned 0x1 [0152.325] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x11ef1 [0152.325] ReadFile (in: hFile=0x34c, lpBuffer=0x2465908, nNumberOfBytesToRead=0x11ef1, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2465908*, lpNumberOfBytesRead=0x19eeb0*=0x11ef1, lpOverlapped=0x0) returned 1 [0152.326] CloseHandle (hObject=0x34c) returned 1 [0152.396] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", lpFilePart=0x0) returned 0x38 [0152.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.396] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qqwlqdbqrfvam vqx4dg.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.398] GetFileType (hFile=0x34c) returned 0x1 [0152.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.398] GetFileType (hFile=0x34c) returned 0x1 [0152.398] WriteFile (in: hFile=0x34c, lpBuffer=0x2255350*, nNumberOfBytesToWrite=0x11f00, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2255350*, lpNumberOfBytesWritten=0x19eea0*=0x11f00, lpOverlapped=0x0) returned 1 [0152.400] CloseHandle (hObject=0x34c) returned 1 [0152.403] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", lpFilePart=0x0) returned 0x38 [0152.403] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf.coom", lpFilePart=0x0) returned 0x3d [0152.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qqwlqdbqrfvam vqx4dg.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31a5460, ftCreationTime.dwHighDateTime=0x1d8274a, ftLastAccessTime.dwLowDateTime=0x744511a0, ftLastAccessTime.dwHighDateTime=0x1d82883, ftLastWriteTime.dwLowDateTime=0x1fafa201, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x11f00)) returned 1 [0152.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.403] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qqwlqdbqrfvam vqx4dg.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qqwlqdbqrfvam vqx4dg.pdf.coom")) returned 1 [0152.404] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", lpFilePart=0x0) returned 0x36 [0152.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.404] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\tdg1tr6sd8r 70ytf.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.404] GetFileType (hFile=0x34c) returned 0x1 [0152.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.404] GetFileType (hFile=0x34c) returned 0x1 [0152.404] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xcfc1 [0152.404] ReadFile (in: hFile=0x34c, lpBuffer=0x226764c, nNumberOfBytesToRead=0xcfc1, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x226764c*, lpNumberOfBytesRead=0x19eeb0*=0xcfc1, lpOverlapped=0x0) returned 1 [0152.405] CloseHandle (hObject=0x34c) returned 1 [0152.429] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", lpFilePart=0x0) returned 0x36 [0152.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.429] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\tdg1tr6sd8r 70ytf.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.431] GetFileType (hFile=0x34c) returned 0x1 [0152.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.431] GetFileType (hFile=0x34c) returned 0x1 [0152.431] WriteFile (in: hFile=0x34c, lpBuffer=0x22db4f0*, nNumberOfBytesToWrite=0xcfd0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22db4f0*, lpNumberOfBytesWritten=0x19eea0*=0xcfd0, lpOverlapped=0x0) returned 1 [0152.434] CloseHandle (hObject=0x34c) returned 1 [0152.436] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", lpFilePart=0x0) returned 0x36 [0152.437] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx.coom", lpFilePart=0x0) returned 0x3b [0152.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.437] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\tdg1tr6sd8r 70ytf.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d63a50, ftCreationTime.dwHighDateTime=0x1d81e3b, ftLastAccessTime.dwLowDateTime=0x72d93c00, ftLastAccessTime.dwHighDateTime=0x1d82988, ftLastWriteTime.dwLowDateTime=0x1fb4bc09, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xcfd0)) returned 1 [0152.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.437] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\tdg1tr6sd8r 70ytf.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\tdg1tr6sd8r 70ytf.docx.coom")) returned 1 [0152.438] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", lpFilePart=0x0) returned 0x31 [0152.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.438] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uhtnuhwyzpoex.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.438] GetFileType (hFile=0x34c) returned 0x1 [0152.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.438] GetFileType (hFile=0x34c) returned 0x1 [0152.438] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x57f2 [0152.439] ReadFile (in: hFile=0x34c, lpBuffer=0x22e8878, nNumberOfBytesToRead=0x57f2, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22e8878*, lpNumberOfBytesRead=0x19eeb0*=0x57f2, lpOverlapped=0x0) returned 1 [0152.440] CloseHandle (hObject=0x34c) returned 1 [0152.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", lpFilePart=0x0) returned 0x31 [0152.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.463] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uhtnuhwyzpoex.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.464] GetFileType (hFile=0x34c) returned 0x1 [0152.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.464] GetFileType (hFile=0x34c) returned 0x1 [0152.464] WriteFile (in: hFile=0x34c, lpBuffer=0x2350e3c*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2350e3c*, lpNumberOfBytesWritten=0x19eea0*=0x5800, lpOverlapped=0x0) returned 1 [0152.466] CloseHandle (hObject=0x34c) returned 1 [0152.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", lpFilePart=0x0) returned 0x31 [0152.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf.coom", lpFilePart=0x0) returned 0x36 [0152.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uhtnuhwyzpoex.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53efdbf0, ftCreationTime.dwHighDateTime=0x1d821c2, ftLastAccessTime.dwLowDateTime=0x74932200, ftLastAccessTime.dwHighDateTime=0x1d8270c, ftLastWriteTime.dwLowDateTime=0x1fb97906, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x5800)) returned 1 [0152.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.468] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uhtnuhwyzpoex.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uhtnuhwyzpoex.pdf.coom")) returned 1 [0152.469] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", lpFilePart=0x0) returned 0x30 [0152.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.469] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uiwqdmyw8ql.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.469] GetFileType (hFile=0x34c) returned 0x1 [0152.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.469] GetFileType (hFile=0x34c) returned 0x1 [0152.469] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x5c40 [0152.469] ReadFile (in: hFile=0x34c, lpBuffer=0x23569c0, nNumberOfBytesToRead=0x5c40, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23569c0*, lpNumberOfBytesRead=0x19eeb0*=0x5c40, lpOverlapped=0x0) returned 1 [0152.471] CloseHandle (hObject=0x34c) returned 1 [0152.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", lpFilePart=0x0) returned 0x30 [0152.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.504] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uiwqdmyw8ql.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.506] GetFileType (hFile=0x34c) returned 0x1 [0152.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.506] GetFileType (hFile=0x34c) returned 0x1 [0152.506] WriteFile (in: hFile=0x34c, lpBuffer=0x23c0510*, nNumberOfBytesToWrite=0x5c50, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23c0510*, lpNumberOfBytesWritten=0x19eea0*=0x5c50, lpOverlapped=0x0) returned 1 [0152.507] CloseHandle (hObject=0x34c) returned 1 [0152.511] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", lpFilePart=0x0) returned 0x30 [0152.511] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx.coom", lpFilePart=0x0) returned 0x35 [0152.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.511] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uiwqdmyw8ql.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6982eec0, ftCreationTime.dwHighDateTime=0x1d7bba7, ftLastAccessTime.dwLowDateTime=0xbbf9d860, ftLastAccessTime.dwHighDateTime=0x1d7d567, ftLastWriteTime.dwLowDateTime=0x1fc00cd6, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x5c50)) returned 1 [0152.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.511] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uiwqdmyw8ql.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uiwqdmyw8ql.docx.coom")) returned 1 [0152.512] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", lpFilePart=0x0) returned 0x29 [0152.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.512] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vcyeh.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.512] GetFileType (hFile=0x34c) returned 0x1 [0152.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.512] GetFileType (hFile=0x34c) returned 0x1 [0152.512] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x17d54 [0152.513] ReadFile (in: hFile=0x34c, lpBuffer=0x3284a50, nNumberOfBytesToRead=0x17d54, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3284a50*, lpNumberOfBytesRead=0x19eeb0*=0x17d54, lpOverlapped=0x0) returned 1 [0152.515] CloseHandle (hObject=0x34c) returned 1 [0152.586] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", lpFilePart=0x0) returned 0x29 [0152.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.587] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vcyeh.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.589] GetFileType (hFile=0x34c) returned 0x1 [0152.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.589] GetFileType (hFile=0x34c) returned 0x1 [0152.589] WriteFile (in: hFile=0x34c, lpBuffer=0x32fbd60*, nNumberOfBytesToWrite=0x17d60, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x32fbd60*, lpNumberOfBytesWritten=0x19eea0*=0x17d60, lpOverlapped=0x0) returned 1 [0152.592] CloseHandle (hObject=0x34c) returned 1 [0152.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", lpFilePart=0x0) returned 0x29 [0152.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc.coom", lpFilePart=0x0) returned 0x2e [0152.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vcyeh.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdba143d0, ftCreationTime.dwHighDateTime=0x1d81ec1, ftLastAccessTime.dwLowDateTime=0x1494afb0, ftLastAccessTime.dwHighDateTime=0x1d8202f, ftLastWriteTime.dwLowDateTime=0x1fcd0b8a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17d60)) returned 1 [0152.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.596] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vcyeh.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vcyeh.doc.coom")) returned 1 [0152.597] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", lpFilePart=0x0) returned 0x33 [0152.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.597] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wlztxestugu f3.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.597] GetFileType (hFile=0x34c) returned 0x1 [0152.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.597] GetFileType (hFile=0x34c) returned 0x1 [0152.597] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x79d1 [0152.598] ReadFile (in: hFile=0x34c, lpBuffer=0x22139b8, nNumberOfBytesToRead=0x79d1, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22139b8*, lpNumberOfBytesRead=0x19eeb0*=0x79d1, lpOverlapped=0x0) returned 1 [0152.598] CloseHandle (hObject=0x34c) returned 1 [0152.619] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", lpFilePart=0x0) returned 0x33 [0152.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.619] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wlztxestugu f3.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.623] GetFileType (hFile=0x34c) returned 0x1 [0152.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.623] GetFileType (hFile=0x34c) returned 0x1 [0152.623] WriteFile (in: hFile=0x34c, lpBuffer=0x2286a38*, nNumberOfBytesToWrite=0x79e0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2286a38*, lpNumberOfBytesWritten=0x19eea0*=0x79e0, lpOverlapped=0x0) returned 1 [0152.625] CloseHandle (hObject=0x34c) returned 1 [0152.626] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", lpFilePart=0x0) returned 0x33 [0152.626] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx.coom", lpFilePart=0x0) returned 0x38 [0152.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wlztxestugu f3.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c075f0, ftCreationTime.dwHighDateTime=0x1d7dd97, ftLastAccessTime.dwLowDateTime=0x3bac3590, ftLastAccessTime.dwHighDateTime=0x1d81aa4, ftLastWriteTime.dwLowDateTime=0x1fd1bffd, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x79e0)) returned 1 [0152.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.627] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wlztxestugu f3.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wlztxestugu f3.xlsx.coom")) returned 1 [0152.627] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", lpFilePart=0x0) returned 0x28 [0152.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.628] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wu7s.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.628] GetFileType (hFile=0x34c) returned 0x1 [0152.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.628] GetFileType (hFile=0x34c) returned 0x1 [0152.628] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x16363 [0152.629] ReadFile (in: hFile=0x34c, lpBuffer=0x3313ae0, nNumberOfBytesToRead=0x16363, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3313ae0*, lpNumberOfBytesRead=0x19eeb0*=0x16363, lpOverlapped=0x0) returned 1 [0152.631] CloseHandle (hObject=0x34c) returned 1 [0152.700] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", lpFilePart=0x0) returned 0x28 [0152.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.700] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wu7s.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.702] GetFileType (hFile=0x34c) returned 0x1 [0152.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.702] GetFileType (hFile=0x34c) returned 0x1 [0152.702] WriteFile (in: hFile=0x34c, lpBuffer=0x3382c40*, nNumberOfBytesToWrite=0x16370, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3382c40*, lpNumberOfBytesWritten=0x19eea0*=0x16370, lpOverlapped=0x0) returned 1 [0152.705] CloseHandle (hObject=0x34c) returned 1 [0152.709] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", lpFilePart=0x0) returned 0x28 [0152.709] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls.coom", lpFilePart=0x0) returned 0x2d [0152.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wu7s.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61beb0, ftCreationTime.dwHighDateTime=0x1d81aa5, ftLastAccessTime.dwLowDateTime=0x48b00210, ftLastAccessTime.dwHighDateTime=0x1d823ca, ftLastWriteTime.dwLowDateTime=0x1fde5204, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x16370)) returned 1 [0152.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.709] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wu7s.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wu7s.xls.coom")) returned 1 [0152.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", lpFilePart=0x0) returned 0x32 [0152.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.714] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wve9flhzacbjm.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.714] GetFileType (hFile=0x34c) returned 0x1 [0152.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.714] GetFileType (hFile=0x34c) returned 0x1 [0152.714] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x7e86 [0152.714] ReadFile (in: hFile=0x34c, lpBuffer=0x22db898, nNumberOfBytesToRead=0x7e86, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22db898*, lpNumberOfBytesRead=0x19eeb0*=0x7e86, lpOverlapped=0x0) returned 1 [0152.715] CloseHandle (hObject=0x34c) returned 1 [0152.738] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", lpFilePart=0x0) returned 0x32 [0152.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.738] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wve9flhzacbjm.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.739] GetFileType (hFile=0x34c) returned 0x1 [0152.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.741] GetFileType (hFile=0x34c) returned 0x1 [0152.741] WriteFile (in: hFile=0x34c, lpBuffer=0x234ff2c*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x234ff2c*, lpNumberOfBytesWritten=0x19eea0*=0x7e90, lpOverlapped=0x0) returned 1 [0152.743] CloseHandle (hObject=0x34c) returned 1 [0152.745] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", lpFilePart=0x0) returned 0x32 [0152.745] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx.coom", lpFilePart=0x0) returned 0x37 [0152.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.745] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wve9flhzacbjm.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x199007f0, ftCreationTime.dwHighDateTime=0x1d8218b, ftLastAccessTime.dwLowDateTime=0x3e7a2700, ftLastAccessTime.dwHighDateTime=0x1d826f7, ftLastWriteTime.dwLowDateTime=0x1fe3c833, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7e90)) returned 1 [0152.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.745] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wve9flhzacbjm.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wve9flhzacbjm.pptx.coom")) returned 1 [0152.746] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", lpFilePart=0x0) returned 0x37 [0152.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.746] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\y8tckri kxxqhv9oqq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.746] GetFileType (hFile=0x34c) returned 0x1 [0152.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.746] GetFileType (hFile=0x34c) returned 0x1 [0152.747] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x5a5a [0152.747] ReadFile (in: hFile=0x34c, lpBuffer=0x2358164, nNumberOfBytesToRead=0x5a5a, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2358164*, lpNumberOfBytesRead=0x19eeb0*=0x5a5a, lpOverlapped=0x0) returned 1 [0152.747] CloseHandle (hObject=0x34c) returned 1 [0152.805] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", lpFilePart=0x0) returned 0x37 [0152.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.805] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\y8tckri kxxqhv9oqq.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.807] GetFileType (hFile=0x34c) returned 0x1 [0152.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.807] GetFileType (hFile=0x34c) returned 0x1 [0152.807] WriteFile (in: hFile=0x34c, lpBuffer=0x23c1308*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23c1308*, lpNumberOfBytesWritten=0x19eea0*=0x5a60, lpOverlapped=0x0) returned 1 [0152.810] CloseHandle (hObject=0x34c) returned 1 [0152.812] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", lpFilePart=0x0) returned 0x37 [0152.812] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx.coom", lpFilePart=0x0) returned 0x3c [0152.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.812] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\y8tckri kxxqhv9oqq.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148e4700, ftCreationTime.dwHighDateTime=0x1d7e3ea, ftLastAccessTime.dwLowDateTime=0xbefc52e0, ftLastAccessTime.dwHighDateTime=0x1d819d7, ftLastWriteTime.dwLowDateTime=0x1fee0221, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x5a60)) returned 1 [0152.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.812] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\y8tckri kxxqhv9oqq.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\y8tckri kxxqhv9oqq.xlsx.coom")) returned 1 [0152.813] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", lpFilePart=0x0) returned 0x2e [0152.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.813] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zjrfdpfcl.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.813] GetFileType (hFile=0x34c) returned 0x1 [0152.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.813] GetFileType (hFile=0x34c) returned 0x1 [0152.813] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x17858 [0152.814] ReadFile (in: hFile=0x34c, lpBuffer=0x3398fd0, nNumberOfBytesToRead=0x17858, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3398fd0*, lpNumberOfBytesRead=0x19eeb0*=0x17858, lpOverlapped=0x0) returned 1 [0152.816] CloseHandle (hObject=0x34c) returned 1 [0152.896] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", lpFilePart=0x0) returned 0x2e [0152.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.896] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zjrfdpfcl.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.898] GetFileType (hFile=0x34c) returned 0x1 [0152.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.898] GetFileType (hFile=0x34c) returned 0x1 [0152.898] WriteFile (in: hFile=0x34c, lpBuffer=0x340e9e8*, nNumberOfBytesToWrite=0x17860, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x340e9e8*, lpNumberOfBytesWritten=0x19eea0*=0x17860, lpOverlapped=0x0) returned 1 [0152.901] CloseHandle (hObject=0x34c) returned 1 [0152.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", lpFilePart=0x0) returned 0x2e [0152.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx.coom", lpFilePart=0x0) returned 0x33 [0152.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zjrfdpfcl.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc5da00, ftCreationTime.dwHighDateTime=0x1d7d439, ftLastAccessTime.dwLowDateTime=0xc0d81010, ftLastAccessTime.dwHighDateTime=0x1d7f1bc, ftLastWriteTime.dwLowDateTime=0x1ffc5007, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17860)) returned 1 [0152.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.906] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zjrfdpfcl.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zjrfdpfcl.xlsx.coom")) returned 1 [0152.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", lpFilePart=0x0) returned 0x2a [0152.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0152.907] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zwafqo.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.907] GetFileType (hFile=0x34c) returned 0x1 [0152.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0152.907] GetFileType (hFile=0x34c) returned 0x1 [0152.907] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x16987 [0152.908] ReadFile (in: hFile=0x34c, lpBuffer=0x3426268, nNumberOfBytesToRead=0x16987, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3426268*, lpNumberOfBytesRead=0x19eeb0*=0x16987, lpOverlapped=0x0) returned 1 [0152.910] CloseHandle (hObject=0x34c) returned 1 [0152.943] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", lpFilePart=0x0) returned 0x2a [0152.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0152.943] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zwafqo.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.945] GetFileType (hFile=0x34c) returned 0x1 [0152.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0152.945] GetFileType (hFile=0x34c) returned 0x1 [0152.945] WriteFile (in: hFile=0x34c, lpBuffer=0x3497270*, nNumberOfBytesToWrite=0x16990, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3497270*, lpNumberOfBytesWritten=0x19eea0*=0x16990, lpOverlapped=0x0) returned 1 [0152.948] CloseHandle (hObject=0x34c) returned 1 [0152.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", lpFilePart=0x0) returned 0x2a [0152.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps.coom", lpFilePart=0x0) returned 0x2f [0152.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0152.953] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zwafqo.pps"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd083fcf0, ftCreationTime.dwHighDateTime=0x1d823c5, ftLastAccessTime.dwLowDateTime=0x7d735750, ftLastAccessTime.dwHighDateTime=0x1d8240f, ftLastWriteTime.dwLowDateTime=0x20038ac9, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x16990)) returned 1 [0152.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0152.953] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zwafqo.pps"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zwafqo.pps.coom")) returned 1 [0152.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0152.954] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", lpFilePart=0x0) returned 0x28 [0152.955] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\", lpFilePart=0x0) returned 0x29 [0152.955] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0152.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee8c) returned 1 [0152.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0152.981] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", lpFilePart=0x0) returned 0x2b [0152.981] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x2c [0152.981] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0152.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee8c) returned 1 [0152.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0152.984] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", lpFilePart=0x0) returned 0x29 [0152.984] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x2a [0152.984] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0152.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee8c) returned 1 [0152.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0152.986] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0152.986] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x2e [0152.986] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690920 [0152.987] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.988] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878917cb, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 1 [0152.988] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0152.988] FindClose (in: hFindFile=0x690920 | out: hFindFile=0x690920) returned 1 [0152.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1 [0152.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1 [0152.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0152.988] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d [0152.988] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x2e [0152.988] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690660 [0152.989] FindNextFileW (in: hFindFile=0x690660, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.989] FindNextFileW (in: hFindFile=0x690660, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878917cb, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 1 [0152.989] FindNextFileW (in: hFindFile=0x690660, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878917cb, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 0 [0152.989] FindClose (in: hFindFile=0x690660 | out: hFindFile=0x690660) returned 1 [0152.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1 [0152.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1 [0152.990] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", nBufferLength=0x105, lpBuffer=0x19e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", lpFilePart=0x0) returned 0x40 [0152.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1 [0152.990] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0152.990] GetFileType (hFile=0x34c) returned 0x1 [0152.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1 [0152.990] GetFileType (hFile=0x34c) returned 0x1 [0152.990] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19eec4 | out: lpFileSizeHigh=0x19eec4*=0x0) returned 0x42400 [0152.991] ReadFile (in: hFile=0x34c, lpBuffer=0x34adc20, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x19ee70, lpOverlapped=0x0 | out: lpBuffer=0x34adc20*, lpNumberOfBytesRead=0x19ee70*=0x42400, lpOverlapped=0x0) returned 1 [0153.005] CloseHandle (hObject=0x34c) returned 1 [0153.083] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", nBufferLength=0x105, lpBuffer=0x19e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", lpFilePart=0x0) returned 0x40 [0153.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eda4) returned 1 [0153.083] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c [0153.088] GetFileType (hFile=0x34c) returned 0x1 [0153.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda0) returned 1 [0153.088] GetFileType (hFile=0x34c) returned 0x1 [0153.088] WriteFile (in: hFile=0x34c, lpBuffer=0x32eaeb0*, nNumberOfBytesToWrite=0x42410, lpNumberOfBytesWritten=0x19ee60, lpOverlapped=0x0 | out: lpBuffer=0x32eaeb0*, lpNumberOfBytesWritten=0x19ee60*=0x42410, lpOverlapped=0x0) returned 1 [0153.095] CloseHandle (hObject=0x34c) returned 1 [0153.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", lpFilePart=0x0) returned 0x40 [0153.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst.coom", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst.coom", lpFilePart=0x0) returned 0x45 [0153.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee48) returned 1 [0153.104] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), fInfoLevelId=0x0, lpFileInformation=0x19eec4 | out: lpFileInformation=0x19eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x201a90f9, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x42410)) returned 1 [0153.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee44) returned 1 [0153.104] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst.coom")) returned 1 [0153.105] CoTaskMemAlloc (cb=0x20c) returned 0x6c0300 [0153.105] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x6c0300 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Pictures") returned 0x0 [0153.107] CoTaskMemFree (pv=0x6c0300) [0153.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x19e9dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e [0153.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1 [0153.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e [0153.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", lpFilePart=0x0) returned 0x1f [0153.107] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfca7f5c1, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfca7f5c1, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6905e0 [0153.107] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfca7f5c1, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfca7f5c1, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.108] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x665ace0, ftCreationTime.dwHighDateTime=0x1d824ef, ftLastAccessTime.dwLowDateTime=0xfbc78c40, ftLastAccessTime.dwHighDateTime=0x1d8299e, ftLastWriteTime.dwLowDateTime=0xfbc78c40, ftLastWriteTime.dwHighDateTime=0x1d8299e, nFileSizeHigh=0x0, nFileSizeLow=0x12fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AkGZ7RwHa9JQW9htg8.jpg", cAlternateFileName="0AKGZ7~1.JPG")) returned 1 [0153.108] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd248e2b0, ftCreationTime.dwHighDateTime=0x1d81e18, ftLastAccessTime.dwLowDateTime=0x366706a0, ftLastAccessTime.dwHighDateTime=0x1d825cb, ftLastWriteTime.dwLowDateTime=0x366706a0, ftLastWriteTime.dwHighDateTime=0x1d825cb, nFileSizeHigh=0x0, nFileSizeLow=0x81ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="1XcD0L9HgO vAf jK.jpg", cAlternateFileName="1XCD0L~1.JPG")) returned 1 [0153.108] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6514d3c0, ftCreationTime.dwHighDateTime=0x1d81f53, ftLastAccessTime.dwLowDateTime=0x213e46e0, ftLastAccessTime.dwHighDateTime=0x1d826e7, ftLastWriteTime.dwLowDateTime=0x213e46e0, ftLastWriteTime.dwHighDateTime=0x1d826e7, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="6HEzLSBE7gYZeO.jpg", cAlternateFileName="6HEZLS~1.JPG")) returned 1 [0153.108] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x838492a0, ftCreationTime.dwHighDateTime=0x1d82219, ftLastAccessTime.dwLowDateTime=0x17efee10, ftLastAccessTime.dwHighDateTime=0x1d826d1, ftLastWriteTime.dwLowDateTime=0x17efee10, ftLastWriteTime.dwHighDateTime=0x1d826d1, nFileSizeHigh=0x0, nFileSizeLow=0xba29, dwReserved0=0x0, dwReserved1=0x0, cFileName="6xK8yFHYt9NwJGM.jpg", cAlternateFileName="6XK8YF~1.JPG")) returned 1 [0153.108] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8d4b30, ftCreationTime.dwHighDateTime=0x1d82066, ftLastAccessTime.dwLowDateTime=0x943c22d0, ftLastAccessTime.dwHighDateTime=0x1d824b1, ftLastWriteTime.dwLowDateTime=0x943c22d0, ftLastWriteTime.dwHighDateTime=0x1d824b1, nFileSizeHigh=0x0, nFileSizeLow=0x7b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="7WI2.gif", cAlternateFileName="")) returned 1 [0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe33cf450, ftCreationTime.dwHighDateTime=0x1d81c4a, ftLastAccessTime.dwLowDateTime=0x1e749d90, ftLastAccessTime.dwHighDateTime=0x1d81faa, ftLastWriteTime.dwLowDateTime=0x1e749d90, ftLastWriteTime.dwHighDateTime=0x1d81faa, nFileSizeHigh=0x0, nFileSizeLow=0xa79e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Jr0lXZI.gif", cAlternateFileName="")) returned 1 [0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59967750, ftCreationTime.dwHighDateTime=0x1d824ea, ftLastAccessTime.dwLowDateTime=0x102d8670, ftLastAccessTime.dwHighDateTime=0x1d8296e, ftLastWriteTime.dwLowDateTime=0x102d8670, ftLastWriteTime.dwHighDateTime=0x1d8296e, nFileSizeHigh=0x0, nFileSizeLow=0xc75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8YcKzqOL.png", cAlternateFileName="")) returned 1 [0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6540fd0, ftCreationTime.dwHighDateTime=0x1d82819, ftLastAccessTime.dwLowDateTime=0x27eca910, ftLastAccessTime.dwHighDateTime=0x1d828c1, ftLastWriteTime.dwLowDateTime=0x27eca910, ftLastWriteTime.dwHighDateTime=0x1d828c1, nFileSizeHigh=0x0, nFileSizeLow=0x9070, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Iwim433q.gif", cAlternateFileName="9IWIM4~1.GIF")) returned 1 [0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90154f0, ftCreationTime.dwHighDateTime=0x1d82895, ftLastAccessTime.dwLowDateTime=0xa483c370, ftLastAccessTime.dwHighDateTime=0x1d82a18, ftLastWriteTime.dwLowDateTime=0xa483c370, ftLastWriteTime.dwHighDateTime=0x1d82a18, nFileSizeHigh=0x0, nFileSizeLow=0x111e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9pPtv35.gif", cAlternateFileName="")) returned 1 [0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebdfd90, ftCreationTime.dwHighDateTime=0x1d81b9c, ftLastAccessTime.dwLowDateTime=0xcaae11a0, ftLastAccessTime.dwHighDateTime=0x1d82526, ftLastWriteTime.dwLowDateTime=0xcaae11a0, ftLastWriteTime.dwHighDateTime=0x1d82526, nFileSizeHigh=0x0, nFileSizeLow=0x11d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-lzQ.gif", cAlternateFileName="")) returned 1 [0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f16bd0, ftCreationTime.dwHighDateTime=0x1d828f6, ftLastAccessTime.dwLowDateTime=0xd4b33690, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0xd4b33690, ftLastWriteTime.dwHighDateTime=0x1d8298a, nFileSizeHigh=0x0, nFileSizeLow=0xbdbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="b4zTcHI.png", cAlternateFileName="")) returned 1 [0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbebb9f0, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0xc4662480, ftLastAccessTime.dwHighDateTime=0x1d825e0, ftLastWriteTime.dwLowDateTime=0xc4662480, ftLastWriteTime.dwHighDateTime=0x1d825e0, nFileSizeHigh=0x0, nFileSizeLow=0xa145, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreSk RqWy7z.png", cAlternateFileName="BRESKR~1.PNG")) returned 1 [0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528f0920, ftCreationTime.dwHighDateTime=0x1d81c40, ftLastAccessTime.dwLowDateTime=0xe0b75bb0, ftLastAccessTime.dwHighDateTime=0x1d8284f, ftLastWriteTime.dwLowDateTime=0xe0b75bb0, ftLastWriteTime.dwHighDateTime=0x1d8284f, nFileSizeHigh=0x0, nFileSizeLow=0xc7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRJpjfC.png", cAlternateFileName="")) returned 1 [0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fa0300, ftCreationTime.dwHighDateTime=0x1d82618, ftLastAccessTime.dwLowDateTime=0xcd9fa800, ftLastAccessTime.dwHighDateTime=0x1d82973, ftLastWriteTime.dwLowDateTime=0xcd9fa800, ftLastWriteTime.dwHighDateTime=0x1d82973, nFileSizeHigh=0x0, nFileSizeLow=0x3a23, dwReserved0=0x0, dwReserved1=0x0, cFileName="d-XNPCTgc1Q9.png", cAlternateFileName="D-XNPC~1.PNG")) returned 1 [0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61cc68e0, ftCreationTime.dwHighDateTime=0x1d81f3a, ftLastAccessTime.dwLowDateTime=0x654ad800, ftLastAccessTime.dwHighDateTime=0x1d8203c, ftLastWriteTime.dwLowDateTime=0x654ad800, ftLastWriteTime.dwHighDateTime=0x1d8203c, nFileSizeHigh=0x0, nFileSizeLow=0x6cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="EzYS-.gif", cAlternateFileName="")) returned 1 [0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f6f0a0, ftCreationTime.dwHighDateTime=0x1d8227b, ftLastAccessTime.dwLowDateTime=0x17e3bb80, ftLastAccessTime.dwHighDateTime=0x1d828b2, ftLastWriteTime.dwLowDateTime=0x17e3bb80, ftLastWriteTime.dwHighDateTime=0x1d828b2, nFileSizeHigh=0x0, nFileSizeLow=0x107e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gSIkAFh.bmp", cAlternateFileName="")) returned 1 [0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b7400, ftCreationTime.dwHighDateTime=0x1d81d2b, ftLastAccessTime.dwLowDateTime=0xdec8e540, ftLastAccessTime.dwHighDateTime=0x1d82867, ftLastWriteTime.dwLowDateTime=0xdec8e540, ftLastWriteTime.dwHighDateTime=0x1d82867, nFileSizeHigh=0x0, nFileSizeLow=0x17783, dwReserved0=0x0, dwReserved1=0x0, cFileName="gXgbf6roC6Lb.jpg", cAlternateFileName="GXGBF6~1.JPG")) returned 1 [0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7daed200, ftCreationTime.dwHighDateTime=0x1d827e6, ftLastAccessTime.dwLowDateTime=0xe2a8d900, ftLastAccessTime.dwHighDateTime=0x1d8282f, ftLastWriteTime.dwLowDateTime=0xe2a8d900, ftLastWriteTime.dwHighDateTime=0x1d8282f, nFileSizeHigh=0x0, nFileSizeLow=0x1391a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hlxInIph.bmp", cAlternateFileName="")) returned 1 [0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dce0530, ftCreationTime.dwHighDateTime=0x1d826a6, ftLastAccessTime.dwLowDateTime=0x646692d0, ftLastAccessTime.dwHighDateTime=0x1d8289d, ftLastWriteTime.dwLowDateTime=0x646692d0, ftLastWriteTime.dwHighDateTime=0x1d8289d, nFileSizeHigh=0x0, nFileSizeLow=0x9c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="I6Fm_t84SE.png", cAlternateFileName="I6FM_T~1.PNG")) returned 1 [0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde0b0ec0, ftCreationTime.dwHighDateTime=0x1d8258e, ftLastAccessTime.dwLowDateTime=0x2e000b40, ftLastAccessTime.dwHighDateTime=0x1d82910, ftLastWriteTime.dwLowDateTime=0x2e000b40, ftLastWriteTime.dwHighDateTime=0x1d82910, nFileSizeHigh=0x0, nFileSizeLow=0x16d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ivsui27SVr1Y3.jpg", cAlternateFileName="IVSUI2~1.JPG")) returned 1 [0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35487f0, ftCreationTime.dwHighDateTime=0x1d827a3, ftLastAccessTime.dwLowDateTime=0xd5ae6b0, ftLastAccessTime.dwHighDateTime=0x1d82877, ftLastWriteTime.dwLowDateTime=0xd5ae6b0, ftLastWriteTime.dwHighDateTime=0x1d82877, nFileSizeHigh=0x0, nFileSizeLow=0xdc9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IWi uLS5p7Z7.gif", cAlternateFileName="IWIULS~1.GIF")) returned 1 [0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382b61d0, ftCreationTime.dwHighDateTime=0x1d8259d, ftLastAccessTime.dwLowDateTime=0x9f502390, ftLastAccessTime.dwHighDateTime=0x1d82800, ftLastWriteTime.dwLowDateTime=0x9f502390, ftLastWriteTime.dwHighDateTime=0x1d82800, nFileSizeHigh=0x0, nFileSizeLow=0x4b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="kWCT8U0903RyGLzL7N.gif", cAlternateFileName="KWCT8U~1.GIF")) returned 1 [0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16116470, ftCreationTime.dwHighDateTime=0x1d8200a, ftLastAccessTime.dwLowDateTime=0x96f1bb50, ftLastAccessTime.dwHighDateTime=0x1d825c1, ftLastWriteTime.dwLowDateTime=0x96f1bb50, ftLastWriteTime.dwHighDateTime=0x1d825c1, nFileSizeHigh=0x0, nFileSizeLow=0x13230, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsOQhqoN27oebZQi8.jpg", cAlternateFileName="LSOQHQ~1.JPG")) returned 1 [0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2a9c50, ftCreationTime.dwHighDateTime=0x1d81a54, ftLastAccessTime.dwLowDateTime=0x941f4030, ftLastAccessTime.dwHighDateTime=0x1d82078, ftLastWriteTime.dwLowDateTime=0x941f4030, ftLastWriteTime.dwHighDateTime=0x1d82078, nFileSizeHigh=0x0, nFileSizeLow=0xfa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="lWibP.gif", cAlternateFileName="")) returned 1 [0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb95b0, ftCreationTime.dwHighDateTime=0x1d821be, ftLastAccessTime.dwLowDateTime=0x866ed1f0, ftLastAccessTime.dwHighDateTime=0x1d82274, ftLastWriteTime.dwLowDateTime=0x866ed1f0, ftLastWriteTime.dwHighDateTime=0x1d82274, nFileSizeHigh=0x0, nFileSizeLow=0x12837, dwReserved0=0x0, dwReserved1=0x0, cFileName="mi45QG6WK.bmp", cAlternateFileName="MI45QG~1.BMP")) returned 1 [0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17995170, ftCreationTime.dwHighDateTime=0x1d81df0, ftLastAccessTime.dwLowDateTime=0x310f83c0, ftLastAccessTime.dwHighDateTime=0x1d81e10, ftLastWriteTime.dwLowDateTime=0x310f83c0, ftLastWriteTime.dwHighDateTime=0x1d81e10, nFileSizeHigh=0x0, nFileSizeLow=0x131f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mJaL9VXieT_.jpg", cAlternateFileName="MJAL9V~1.JPG")) returned 1 [0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6eb750, ftCreationTime.dwHighDateTime=0x1d8299b, ftLastAccessTime.dwLowDateTime=0x43267d80, ftLastAccessTime.dwHighDateTime=0x1d82a17, ftLastWriteTime.dwLowDateTime=0x43267d80, ftLastWriteTime.dwHighDateTime=0x1d82a17, nFileSizeHigh=0x0, nFileSizeLow=0xb385, dwReserved0=0x0, dwReserved1=0x0, cFileName="N7eAuVXdYrrsb7gqOWk.gif", cAlternateFileName="N7EAUV~1.GIF")) returned 1 [0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf90a3270, ftCreationTime.dwHighDateTime=0x1d81d94, ftLastAccessTime.dwLowDateTime=0xdbb79470, ftLastAccessTime.dwHighDateTime=0x1d81f91, ftLastWriteTime.dwLowDateTime=0xdbb79470, ftLastWriteTime.dwHighDateTime=0x1d81f91, nFileSizeHigh=0x0, nFileSizeLow=0xc88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLit5D.bmp", cAlternateFileName="")) returned 1 [0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4844e550, ftCreationTime.dwHighDateTime=0x1d81ae4, ftLastAccessTime.dwLowDateTime=0xe15bdb00, ftLastAccessTime.dwHighDateTime=0x1d81f39, ftLastWriteTime.dwLowDateTime=0xe15bdb00, ftLastWriteTime.dwHighDateTime=0x1d81f39, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="prgQYDqfEtZPsUF.bmp", cAlternateFileName="PRGQYD~1.BMP")) returned 1 [0153.114] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0153.114] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1906ebb0, ftCreationTime.dwHighDateTime=0x1d82676, ftLastAccessTime.dwLowDateTime=0xa2a90710, ftLastAccessTime.dwHighDateTime=0x1d829b7, ftLastWriteTime.dwLowDateTime=0xa2a90710, ftLastWriteTime.dwHighDateTime=0x1d829b7, nFileSizeHigh=0x0, nFileSizeLow=0x6992, dwReserved0=0x0, dwReserved1=0x0, cFileName="srPT.bmp", cAlternateFileName="")) returned 1 [0153.115] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae76680, ftCreationTime.dwHighDateTime=0x1d827e5, ftLastAccessTime.dwLowDateTime=0xfb7a2390, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0xfb7a2390, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x6ebb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssZyCkQ2_.png", cAlternateFileName="SSZYCK~1.PNG")) returned 1 [0153.115] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5cf6670, ftCreationTime.dwHighDateTime=0x1d81baa, ftLastAccessTime.dwLowDateTime=0x4a155b70, ftLastAccessTime.dwHighDateTime=0x1d823eb, ftLastWriteTime.dwLowDateTime=0x4a155b70, ftLastWriteTime.dwHighDateTime=0x1d823eb, nFileSizeHigh=0x0, nFileSizeLow=0x40be, dwReserved0=0x0, dwReserved1=0x0, cFileName="sy8Zc6o0W2Dpzb.jpg", cAlternateFileName="SY8ZC6~1.JPG")) returned 1 [0153.115] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea8680, ftCreationTime.dwHighDateTime=0x1d81c3d, ftLastAccessTime.dwLowDateTime=0x53695f10, ftLastAccessTime.dwHighDateTime=0x1d8228c, ftLastWriteTime.dwLowDateTime=0x53695f10, ftLastWriteTime.dwHighDateTime=0x1d8228c, nFileSizeHigh=0x0, nFileSizeLow=0x14dce, dwReserved0=0x0, dwReserved1=0x0, cFileName="thhlqm_vXfrhAkJgqh4.bmp", cAlternateFileName="THHLQM~1.BMP")) returned 1 [0153.115] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dd84b0, ftCreationTime.dwHighDateTime=0x1d81f2c, ftLastAccessTime.dwLowDateTime=0xb3842800, ftLastAccessTime.dwHighDateTime=0x1d8228f, ftLastWriteTime.dwLowDateTime=0xb3842800, ftLastWriteTime.dwHighDateTime=0x1d8228f, nFileSizeHigh=0x0, nFileSizeLow=0xc6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tq-YO c2w6Tz7VNGz.bmp", cAlternateFileName="TQ-YOC~1.BMP")) returned 1 [0153.115] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa9b3c0, ftCreationTime.dwHighDateTime=0x1d81d89, ftLastAccessTime.dwLowDateTime=0x66c4d260, ftLastAccessTime.dwHighDateTime=0x1d822f0, ftLastWriteTime.dwLowDateTime=0x66c4d260, ftLastWriteTime.dwHighDateTime=0x1d822f0, nFileSizeHigh=0x0, nFileSizeLow=0xd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vmb OG1vu5V_PXk.png", cAlternateFileName="VMBOG1~1.PNG")) returned 1 [0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d443bb0, ftCreationTime.dwHighDateTime=0x1d8223a, ftLastAccessTime.dwLowDateTime=0xeebefd90, ftLastAccessTime.dwHighDateTime=0x1d823d5, ftLastWriteTime.dwLowDateTime=0xeebefd90, ftLastWriteTime.dwHighDateTime=0x1d823d5, nFileSizeHigh=0x0, nFileSizeLow=0xa0b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="wMiQ1fW9ts.gif", cAlternateFileName="WMIQ1F~1.GIF")) returned 1 [0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x346fc890, ftCreationTime.dwHighDateTime=0x1d822ac, ftLastAccessTime.dwLowDateTime=0xd286edf0, ftLastAccessTime.dwHighDateTime=0x1d8285c, ftLastWriteTime.dwLowDateTime=0xd286edf0, ftLastWriteTime.dwHighDateTime=0x1d8285c, nFileSizeHigh=0x0, nFileSizeLow=0x5ed7, dwReserved0=0x0, dwReserved1=0x0, cFileName="X1UMFrp.gif", cAlternateFileName="")) returned 1 [0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148ccbf0, ftCreationTime.dwHighDateTime=0x1d8283c, ftLastAccessTime.dwLowDateTime=0xd5db9450, ftLastAccessTime.dwHighDateTime=0x1d82966, ftLastWriteTime.dwLowDateTime=0xd5db9450, ftLastWriteTime.dwHighDateTime=0x1d82966, nFileSizeHigh=0x0, nFileSizeLow=0x11589, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFGLMn64yPgu2VdKY.gif", cAlternateFileName="XFGLMN~1.GIF")) returned 1 [0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3ae720, ftCreationTime.dwHighDateTime=0x1d820f5, ftLastAccessTime.dwLowDateTime=0x88ac5290, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0x88ac5290, ftLastWriteTime.dwHighDateTime=0x1d8298a, nFileSizeHigh=0x0, nFileSizeLow=0x28b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZfAtYXdgQ7TzJo4.bmp", cAlternateFileName="ZFATYX~1.BMP")) returned 1 [0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df1b940, ftCreationTime.dwHighDateTime=0x1d819db, ftLastAccessTime.dwLowDateTime=0x2ff12ab0, ftLastAccessTime.dwHighDateTime=0x1d81ccc, ftLastWriteTime.dwLowDateTime=0x2ff12ab0, ftLastWriteTime.dwHighDateTime=0x1d81ccc, nFileSizeHigh=0x0, nFileSizeLow=0x6c49, dwReserved0=0x0, dwReserved1=0x0, cFileName="_LbBOR Qp.bmp", cAlternateFileName="_LBBOR~1.BMP")) returned 1 [0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0153.116] FindClose (in: hFindFile=0x6905e0 | out: hFindFile=0x6905e0) returned 1 [0153.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1 [0153.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1 [0153.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1 [0153.117] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e [0153.117] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", lpFilePart=0x0) returned 0x1f [0153.117] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfca7f5c1, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfca7f5c1, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6905e0 [0153.117] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfca7f5c1, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfca7f5c1, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.118] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x665ace0, ftCreationTime.dwHighDateTime=0x1d824ef, ftLastAccessTime.dwLowDateTime=0xfbc78c40, ftLastAccessTime.dwHighDateTime=0x1d8299e, ftLastWriteTime.dwLowDateTime=0xfbc78c40, ftLastWriteTime.dwHighDateTime=0x1d8299e, nFileSizeHigh=0x0, nFileSizeLow=0x12fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AkGZ7RwHa9JQW9htg8.jpg", cAlternateFileName="0AKGZ7~1.JPG")) returned 1 [0153.118] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd248e2b0, ftCreationTime.dwHighDateTime=0x1d81e18, ftLastAccessTime.dwLowDateTime=0x366706a0, ftLastAccessTime.dwHighDateTime=0x1d825cb, ftLastWriteTime.dwLowDateTime=0x366706a0, ftLastWriteTime.dwHighDateTime=0x1d825cb, nFileSizeHigh=0x0, nFileSizeLow=0x81ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="1XcD0L9HgO vAf jK.jpg", cAlternateFileName="1XCD0L~1.JPG")) returned 1 [0153.118] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6514d3c0, ftCreationTime.dwHighDateTime=0x1d81f53, ftLastAccessTime.dwLowDateTime=0x213e46e0, ftLastAccessTime.dwHighDateTime=0x1d826e7, ftLastWriteTime.dwLowDateTime=0x213e46e0, ftLastWriteTime.dwHighDateTime=0x1d826e7, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="6HEzLSBE7gYZeO.jpg", cAlternateFileName="6HEZLS~1.JPG")) returned 1 [0153.118] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x838492a0, ftCreationTime.dwHighDateTime=0x1d82219, ftLastAccessTime.dwLowDateTime=0x17efee10, ftLastAccessTime.dwHighDateTime=0x1d826d1, ftLastWriteTime.dwLowDateTime=0x17efee10, ftLastWriteTime.dwHighDateTime=0x1d826d1, nFileSizeHigh=0x0, nFileSizeLow=0xba29, dwReserved0=0x0, dwReserved1=0x0, cFileName="6xK8yFHYt9NwJGM.jpg", cAlternateFileName="6XK8YF~1.JPG")) returned 1 [0153.118] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8d4b30, ftCreationTime.dwHighDateTime=0x1d82066, ftLastAccessTime.dwLowDateTime=0x943c22d0, ftLastAccessTime.dwHighDateTime=0x1d824b1, ftLastWriteTime.dwLowDateTime=0x943c22d0, ftLastWriteTime.dwHighDateTime=0x1d824b1, nFileSizeHigh=0x0, nFileSizeLow=0x7b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="7WI2.gif", cAlternateFileName="")) returned 1 [0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe33cf450, ftCreationTime.dwHighDateTime=0x1d81c4a, ftLastAccessTime.dwLowDateTime=0x1e749d90, ftLastAccessTime.dwHighDateTime=0x1d81faa, ftLastWriteTime.dwLowDateTime=0x1e749d90, ftLastWriteTime.dwHighDateTime=0x1d81faa, nFileSizeHigh=0x0, nFileSizeLow=0xa79e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Jr0lXZI.gif", cAlternateFileName="")) returned 1 [0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59967750, ftCreationTime.dwHighDateTime=0x1d824ea, ftLastAccessTime.dwLowDateTime=0x102d8670, ftLastAccessTime.dwHighDateTime=0x1d8296e, ftLastWriteTime.dwLowDateTime=0x102d8670, ftLastWriteTime.dwHighDateTime=0x1d8296e, nFileSizeHigh=0x0, nFileSizeLow=0xc75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8YcKzqOL.png", cAlternateFileName="")) returned 1 [0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6540fd0, ftCreationTime.dwHighDateTime=0x1d82819, ftLastAccessTime.dwLowDateTime=0x27eca910, ftLastAccessTime.dwHighDateTime=0x1d828c1, ftLastWriteTime.dwLowDateTime=0x27eca910, ftLastWriteTime.dwHighDateTime=0x1d828c1, nFileSizeHigh=0x0, nFileSizeLow=0x9070, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Iwim433q.gif", cAlternateFileName="9IWIM4~1.GIF")) returned 1 [0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90154f0, ftCreationTime.dwHighDateTime=0x1d82895, ftLastAccessTime.dwLowDateTime=0xa483c370, ftLastAccessTime.dwHighDateTime=0x1d82a18, ftLastWriteTime.dwLowDateTime=0xa483c370, ftLastWriteTime.dwHighDateTime=0x1d82a18, nFileSizeHigh=0x0, nFileSizeLow=0x111e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9pPtv35.gif", cAlternateFileName="")) returned 1 [0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebdfd90, ftCreationTime.dwHighDateTime=0x1d81b9c, ftLastAccessTime.dwLowDateTime=0xcaae11a0, ftLastAccessTime.dwHighDateTime=0x1d82526, ftLastWriteTime.dwLowDateTime=0xcaae11a0, ftLastWriteTime.dwHighDateTime=0x1d82526, nFileSizeHigh=0x0, nFileSizeLow=0x11d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-lzQ.gif", cAlternateFileName="")) returned 1 [0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f16bd0, ftCreationTime.dwHighDateTime=0x1d828f6, ftLastAccessTime.dwLowDateTime=0xd4b33690, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0xd4b33690, ftLastWriteTime.dwHighDateTime=0x1d8298a, nFileSizeHigh=0x0, nFileSizeLow=0xbdbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="b4zTcHI.png", cAlternateFileName="")) returned 1 [0153.120] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbebb9f0, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0xc4662480, ftLastAccessTime.dwHighDateTime=0x1d825e0, ftLastWriteTime.dwLowDateTime=0xc4662480, ftLastWriteTime.dwHighDateTime=0x1d825e0, nFileSizeHigh=0x0, nFileSizeLow=0xa145, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreSk RqWy7z.png", cAlternateFileName="BRESKR~1.PNG")) returned 1 [0153.120] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528f0920, ftCreationTime.dwHighDateTime=0x1d81c40, ftLastAccessTime.dwLowDateTime=0xe0b75bb0, ftLastAccessTime.dwHighDateTime=0x1d8284f, ftLastWriteTime.dwLowDateTime=0xe0b75bb0, ftLastWriteTime.dwHighDateTime=0x1d8284f, nFileSizeHigh=0x0, nFileSizeLow=0xc7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRJpjfC.png", cAlternateFileName="")) returned 1 [0153.120] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0153.120] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fa0300, ftCreationTime.dwHighDateTime=0x1d82618, ftLastAccessTime.dwLowDateTime=0xcd9fa800, ftLastAccessTime.dwHighDateTime=0x1d82973, ftLastWriteTime.dwLowDateTime=0xcd9fa800, ftLastWriteTime.dwHighDateTime=0x1d82973, nFileSizeHigh=0x0, nFileSizeLow=0x3a23, dwReserved0=0x0, dwReserved1=0x0, cFileName="d-XNPCTgc1Q9.png", cAlternateFileName="D-XNPC~1.PNG")) returned 1 [0153.120] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0153.121] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61cc68e0, ftCreationTime.dwHighDateTime=0x1d81f3a, ftLastAccessTime.dwLowDateTime=0x654ad800, ftLastAccessTime.dwHighDateTime=0x1d8203c, ftLastWriteTime.dwLowDateTime=0x654ad800, ftLastWriteTime.dwHighDateTime=0x1d8203c, nFileSizeHigh=0x0, nFileSizeLow=0x6cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="EzYS-.gif", cAlternateFileName="")) returned 1 [0153.121] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f6f0a0, ftCreationTime.dwHighDateTime=0x1d8227b, ftLastAccessTime.dwLowDateTime=0x17e3bb80, ftLastAccessTime.dwHighDateTime=0x1d828b2, ftLastWriteTime.dwLowDateTime=0x17e3bb80, ftLastWriteTime.dwHighDateTime=0x1d828b2, nFileSizeHigh=0x0, nFileSizeLow=0x107e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gSIkAFh.bmp", cAlternateFileName="")) returned 1 [0153.121] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b7400, ftCreationTime.dwHighDateTime=0x1d81d2b, ftLastAccessTime.dwLowDateTime=0xdec8e540, ftLastAccessTime.dwHighDateTime=0x1d82867, ftLastWriteTime.dwLowDateTime=0xdec8e540, ftLastWriteTime.dwHighDateTime=0x1d82867, nFileSizeHigh=0x0, nFileSizeLow=0x17783, dwReserved0=0x0, dwReserved1=0x0, cFileName="gXgbf6roC6Lb.jpg", cAlternateFileName="GXGBF6~1.JPG")) returned 1 [0153.121] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7daed200, ftCreationTime.dwHighDateTime=0x1d827e6, ftLastAccessTime.dwLowDateTime=0xe2a8d900, ftLastAccessTime.dwHighDateTime=0x1d8282f, ftLastWriteTime.dwLowDateTime=0xe2a8d900, ftLastWriteTime.dwHighDateTime=0x1d8282f, nFileSizeHigh=0x0, nFileSizeLow=0x1391a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hlxInIph.bmp", cAlternateFileName="")) returned 1 [0153.121] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dce0530, ftCreationTime.dwHighDateTime=0x1d826a6, ftLastAccessTime.dwLowDateTime=0x646692d0, ftLastAccessTime.dwHighDateTime=0x1d8289d, ftLastWriteTime.dwLowDateTime=0x646692d0, ftLastWriteTime.dwHighDateTime=0x1d8289d, nFileSizeHigh=0x0, nFileSizeLow=0x9c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="I6Fm_t84SE.png", cAlternateFileName="I6FM_T~1.PNG")) returned 1 [0153.122] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde0b0ec0, ftCreationTime.dwHighDateTime=0x1d8258e, ftLastAccessTime.dwLowDateTime=0x2e000b40, ftLastAccessTime.dwHighDateTime=0x1d82910, ftLastWriteTime.dwLowDateTime=0x2e000b40, ftLastWriteTime.dwHighDateTime=0x1d82910, nFileSizeHigh=0x0, nFileSizeLow=0x16d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ivsui27SVr1Y3.jpg", cAlternateFileName="IVSUI2~1.JPG")) returned 1 [0153.122] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35487f0, ftCreationTime.dwHighDateTime=0x1d827a3, ftLastAccessTime.dwLowDateTime=0xd5ae6b0, ftLastAccessTime.dwHighDateTime=0x1d82877, ftLastWriteTime.dwLowDateTime=0xd5ae6b0, ftLastWriteTime.dwHighDateTime=0x1d82877, nFileSizeHigh=0x0, nFileSizeLow=0xdc9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IWi uLS5p7Z7.gif", cAlternateFileName="IWIULS~1.GIF")) returned 1 [0153.122] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382b61d0, ftCreationTime.dwHighDateTime=0x1d8259d, ftLastAccessTime.dwLowDateTime=0x9f502390, ftLastAccessTime.dwHighDateTime=0x1d82800, ftLastWriteTime.dwLowDateTime=0x9f502390, ftLastWriteTime.dwHighDateTime=0x1d82800, nFileSizeHigh=0x0, nFileSizeLow=0x4b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="kWCT8U0903RyGLzL7N.gif", cAlternateFileName="KWCT8U~1.GIF")) returned 1 [0153.122] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16116470, ftCreationTime.dwHighDateTime=0x1d8200a, ftLastAccessTime.dwLowDateTime=0x96f1bb50, ftLastAccessTime.dwHighDateTime=0x1d825c1, ftLastWriteTime.dwLowDateTime=0x96f1bb50, ftLastWriteTime.dwHighDateTime=0x1d825c1, nFileSizeHigh=0x0, nFileSizeLow=0x13230, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsOQhqoN27oebZQi8.jpg", cAlternateFileName="LSOQHQ~1.JPG")) returned 1 [0153.122] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2a9c50, ftCreationTime.dwHighDateTime=0x1d81a54, ftLastAccessTime.dwLowDateTime=0x941f4030, ftLastAccessTime.dwHighDateTime=0x1d82078, ftLastWriteTime.dwLowDateTime=0x941f4030, ftLastWriteTime.dwHighDateTime=0x1d82078, nFileSizeHigh=0x0, nFileSizeLow=0xfa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="lWibP.gif", cAlternateFileName="")) returned 1 [0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb95b0, ftCreationTime.dwHighDateTime=0x1d821be, ftLastAccessTime.dwLowDateTime=0x866ed1f0, ftLastAccessTime.dwHighDateTime=0x1d82274, ftLastWriteTime.dwLowDateTime=0x866ed1f0, ftLastWriteTime.dwHighDateTime=0x1d82274, nFileSizeHigh=0x0, nFileSizeLow=0x12837, dwReserved0=0x0, dwReserved1=0x0, cFileName="mi45QG6WK.bmp", cAlternateFileName="MI45QG~1.BMP")) returned 1 [0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17995170, ftCreationTime.dwHighDateTime=0x1d81df0, ftLastAccessTime.dwLowDateTime=0x310f83c0, ftLastAccessTime.dwHighDateTime=0x1d81e10, ftLastWriteTime.dwLowDateTime=0x310f83c0, ftLastWriteTime.dwHighDateTime=0x1d81e10, nFileSizeHigh=0x0, nFileSizeLow=0x131f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mJaL9VXieT_.jpg", cAlternateFileName="MJAL9V~1.JPG")) returned 1 [0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6eb750, ftCreationTime.dwHighDateTime=0x1d8299b, ftLastAccessTime.dwLowDateTime=0x43267d80, ftLastAccessTime.dwHighDateTime=0x1d82a17, ftLastWriteTime.dwLowDateTime=0x43267d80, ftLastWriteTime.dwHighDateTime=0x1d82a17, nFileSizeHigh=0x0, nFileSizeLow=0xb385, dwReserved0=0x0, dwReserved1=0x0, cFileName="N7eAuVXdYrrsb7gqOWk.gif", cAlternateFileName="N7EAUV~1.GIF")) returned 1 [0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf90a3270, ftCreationTime.dwHighDateTime=0x1d81d94, ftLastAccessTime.dwLowDateTime=0xdbb79470, ftLastAccessTime.dwHighDateTime=0x1d81f91, ftLastWriteTime.dwLowDateTime=0xdbb79470, ftLastWriteTime.dwHighDateTime=0x1d81f91, nFileSizeHigh=0x0, nFileSizeLow=0xc88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLit5D.bmp", cAlternateFileName="")) returned 1 [0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4844e550, ftCreationTime.dwHighDateTime=0x1d81ae4, ftLastAccessTime.dwLowDateTime=0xe15bdb00, ftLastAccessTime.dwHighDateTime=0x1d81f39, ftLastWriteTime.dwLowDateTime=0xe15bdb00, ftLastWriteTime.dwHighDateTime=0x1d81f39, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="prgQYDqfEtZPsUF.bmp", cAlternateFileName="PRGQYD~1.BMP")) returned 1 [0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0153.131] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1906ebb0, ftCreationTime.dwHighDateTime=0x1d82676, ftLastAccessTime.dwLowDateTime=0xa2a90710, ftLastAccessTime.dwHighDateTime=0x1d829b7, ftLastWriteTime.dwLowDateTime=0xa2a90710, ftLastWriteTime.dwHighDateTime=0x1d829b7, nFileSizeHigh=0x0, nFileSizeLow=0x6992, dwReserved0=0x0, dwReserved1=0x0, cFileName="srPT.bmp", cAlternateFileName="")) returned 1 [0153.131] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae76680, ftCreationTime.dwHighDateTime=0x1d827e5, ftLastAccessTime.dwLowDateTime=0xfb7a2390, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0xfb7a2390, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x6ebb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssZyCkQ2_.png", cAlternateFileName="SSZYCK~1.PNG")) returned 1 [0153.131] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5cf6670, ftCreationTime.dwHighDateTime=0x1d81baa, ftLastAccessTime.dwLowDateTime=0x4a155b70, ftLastAccessTime.dwHighDateTime=0x1d823eb, ftLastWriteTime.dwLowDateTime=0x4a155b70, ftLastWriteTime.dwHighDateTime=0x1d823eb, nFileSizeHigh=0x0, nFileSizeLow=0x40be, dwReserved0=0x0, dwReserved1=0x0, cFileName="sy8Zc6o0W2Dpzb.jpg", cAlternateFileName="SY8ZC6~1.JPG")) returned 1 [0153.131] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea8680, ftCreationTime.dwHighDateTime=0x1d81c3d, ftLastAccessTime.dwLowDateTime=0x53695f10, ftLastAccessTime.dwHighDateTime=0x1d8228c, ftLastWriteTime.dwLowDateTime=0x53695f10, ftLastWriteTime.dwHighDateTime=0x1d8228c, nFileSizeHigh=0x0, nFileSizeLow=0x14dce, dwReserved0=0x0, dwReserved1=0x0, cFileName="thhlqm_vXfrhAkJgqh4.bmp", cAlternateFileName="THHLQM~1.BMP")) returned 1 [0153.131] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dd84b0, ftCreationTime.dwHighDateTime=0x1d81f2c, ftLastAccessTime.dwLowDateTime=0xb3842800, ftLastAccessTime.dwHighDateTime=0x1d8228f, ftLastWriteTime.dwLowDateTime=0xb3842800, ftLastWriteTime.dwHighDateTime=0x1d8228f, nFileSizeHigh=0x0, nFileSizeLow=0xc6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tq-YO c2w6Tz7VNGz.bmp", cAlternateFileName="TQ-YOC~1.BMP")) returned 1 [0153.132] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa9b3c0, ftCreationTime.dwHighDateTime=0x1d81d89, ftLastAccessTime.dwLowDateTime=0x66c4d260, ftLastAccessTime.dwHighDateTime=0x1d822f0, ftLastWriteTime.dwLowDateTime=0x66c4d260, ftLastWriteTime.dwHighDateTime=0x1d822f0, nFileSizeHigh=0x0, nFileSizeLow=0xd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vmb OG1vu5V_PXk.png", cAlternateFileName="VMBOG1~1.PNG")) returned 1 [0153.132] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d443bb0, ftCreationTime.dwHighDateTime=0x1d8223a, ftLastAccessTime.dwLowDateTime=0xeebefd90, ftLastAccessTime.dwHighDateTime=0x1d823d5, ftLastWriteTime.dwLowDateTime=0xeebefd90, ftLastWriteTime.dwHighDateTime=0x1d823d5, nFileSizeHigh=0x0, nFileSizeLow=0xa0b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="wMiQ1fW9ts.gif", cAlternateFileName="WMIQ1F~1.GIF")) returned 1 [0153.132] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x346fc890, ftCreationTime.dwHighDateTime=0x1d822ac, ftLastAccessTime.dwLowDateTime=0xd286edf0, ftLastAccessTime.dwHighDateTime=0x1d8285c, ftLastWriteTime.dwLowDateTime=0xd286edf0, ftLastWriteTime.dwHighDateTime=0x1d8285c, nFileSizeHigh=0x0, nFileSizeLow=0x5ed7, dwReserved0=0x0, dwReserved1=0x0, cFileName="X1UMFrp.gif", cAlternateFileName="")) returned 1 [0153.132] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148ccbf0, ftCreationTime.dwHighDateTime=0x1d8283c, ftLastAccessTime.dwLowDateTime=0xd5db9450, ftLastAccessTime.dwHighDateTime=0x1d82966, ftLastWriteTime.dwLowDateTime=0xd5db9450, ftLastWriteTime.dwHighDateTime=0x1d82966, nFileSizeHigh=0x0, nFileSizeLow=0x11589, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFGLMn64yPgu2VdKY.gif", cAlternateFileName="XFGLMN~1.GIF")) returned 1 [0153.133] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3ae720, ftCreationTime.dwHighDateTime=0x1d820f5, ftLastAccessTime.dwLowDateTime=0x88ac5290, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0x88ac5290, ftLastWriteTime.dwHighDateTime=0x1d8298a, nFileSizeHigh=0x0, nFileSizeLow=0x28b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZfAtYXdgQ7TzJo4.bmp", cAlternateFileName="ZFATYX~1.BMP")) returned 1 [0153.133] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df1b940, ftCreationTime.dwHighDateTime=0x1d819db, ftLastAccessTime.dwLowDateTime=0x2ff12ab0, ftLastAccessTime.dwHighDateTime=0x1d81ccc, ftLastWriteTime.dwLowDateTime=0x2ff12ab0, ftLastWriteTime.dwHighDateTime=0x1d81ccc, nFileSizeHigh=0x0, nFileSizeLow=0x6c49, dwReserved0=0x0, dwReserved1=0x0, cFileName="_LbBOR Qp.bmp", cAlternateFileName="_LBBOR~1.BMP")) returned 1 [0153.133] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df1b940, ftCreationTime.dwHighDateTime=0x1d819db, ftLastAccessTime.dwLowDateTime=0x2ff12ab0, ftLastAccessTime.dwHighDateTime=0x1d81ccc, ftLastWriteTime.dwLowDateTime=0x2ff12ab0, ftLastWriteTime.dwHighDateTime=0x1d81ccc, nFileSizeHigh=0x0, nFileSizeLow=0x6c49, dwReserved0=0x0, dwReserved1=0x0, cFileName="_LbBOR Qp.bmp", cAlternateFileName="_LBBOR~1.BMP")) returned 0 [0153.133] FindClose (in: hFindFile=0x6905e0 | out: hFindFile=0x6905e0) returned 1 [0153.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1 [0153.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1 [0153.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", lpFilePart=0x0) returned 0x36 [0153.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.134] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\0akgz7rwha9jqw9htg8.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.134] GetFileType (hFile=0x350) returned 0x1 [0153.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.134] GetFileType (hFile=0x350) returned 0x1 [0153.134] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x12fa8 [0153.134] ReadFile (in: hFile=0x350, lpBuffer=0x21e1e8c, nNumberOfBytesToRead=0x12fa8, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x21e1e8c*, lpNumberOfBytesRead=0x19eeb0*=0x12fa8, lpOverlapped=0x0) returned 1 [0153.136] CloseHandle (hObject=0x350) returned 1 [0153.203] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", lpFilePart=0x0) returned 0x36 [0153.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.203] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\0akgz7rwha9jqw9htg8.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.207] GetFileType (hFile=0x350) returned 0x1 [0153.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.207] GetFileType (hFile=0x350) returned 0x1 [0153.207] WriteFile (in: hFile=0x350, lpBuffer=0x2267ccc*, nNumberOfBytesToWrite=0x12fb0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2267ccc*, lpNumberOfBytesWritten=0x19eea0*=0x12fb0, lpOverlapped=0x0) returned 1 [0153.210] CloseHandle (hObject=0x350) returned 1 [0153.214] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", lpFilePart=0x0) returned 0x36 [0153.214] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg.coom", lpFilePart=0x0) returned 0x3b [0153.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.214] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\0akgz7rwha9jqw9htg8.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x665ace0, ftCreationTime.dwHighDateTime=0x1d824ef, ftLastAccessTime.dwLowDateTime=0xfbc78c40, ftLastAccessTime.dwHighDateTime=0x1d8299e, ftLastWriteTime.dwLowDateTime=0x202b5f0a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x12fb0)) returned 1 [0153.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.215] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\0akgz7rwha9jqw9htg8.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\0akgz7rwha9jqw9htg8.jpg.coom")) returned 1 [0153.216] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", lpFilePart=0x0) returned 0x34 [0153.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.216] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\1xcd0l9hgo vaf jk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.216] GetFileType (hFile=0x350) returned 0x1 [0153.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.216] GetFileType (hFile=0x350) returned 0x1 [0153.216] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x81ef [0153.216] ReadFile (in: hFile=0x350, lpBuffer=0x227b044, nNumberOfBytesToRead=0x81ef, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x227b044*, lpNumberOfBytesRead=0x19eeb0*=0x81ef, lpOverlapped=0x0) returned 1 [0153.218] CloseHandle (hObject=0x350) returned 1 [0153.299] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", lpFilePart=0x0) returned 0x34 [0153.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.299] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\1xcd0l9hgo vaf jk.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.301] GetFileType (hFile=0x350) returned 0x1 [0153.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.302] GetFileType (hFile=0x350) returned 0x1 [0153.302] WriteFile (in: hFile=0x350, lpBuffer=0x22f07b8*, nNumberOfBytesToWrite=0x81f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22f07b8*, lpNumberOfBytesWritten=0x19eea0*=0x81f0, lpOverlapped=0x0) returned 1 [0153.304] CloseHandle (hObject=0x350) returned 1 [0153.306] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", lpFilePart=0x0) returned 0x34 [0153.306] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg.coom", lpFilePart=0x0) returned 0x39 [0153.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\1xcd0l9hgo vaf jk.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd248e2b0, ftCreationTime.dwHighDateTime=0x1d81e18, ftLastAccessTime.dwLowDateTime=0x366706a0, ftLastAccessTime.dwHighDateTime=0x1d825cb, ftLastWriteTime.dwLowDateTime=0x203971af, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x81f0)) returned 1 [0153.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.307] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\1xcd0l9hgo vaf jk.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\1xcd0l9hgo vaf jk.jpg.coom")) returned 1 [0153.308] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", lpFilePart=0x0) returned 0x31 [0153.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.308] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6hezlsbe7gyzeo.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.308] GetFileType (hFile=0x350) returned 0x1 [0153.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.308] GetFileType (hFile=0x350) returned 0x1 [0153.308] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x16cbe [0153.308] ReadFile (in: hFile=0x350, lpBuffer=0x3353240, nNumberOfBytesToRead=0x16cbe, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3353240*, lpNumberOfBytesRead=0x19eeb0*=0x16cbe, lpOverlapped=0x0) returned 1 [0153.310] CloseHandle (hObject=0x350) returned 1 [0153.346] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", lpFilePart=0x0) returned 0x31 [0153.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.347] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6hezlsbe7gyzeo.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.349] GetFileType (hFile=0x350) returned 0x1 [0153.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.349] GetFileType (hFile=0x350) returned 0x1 [0153.349] WriteFile (in: hFile=0x350, lpBuffer=0x33c5240*, nNumberOfBytesToWrite=0x16cc0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x33c5240*, lpNumberOfBytesWritten=0x19eea0*=0x16cc0, lpOverlapped=0x0) returned 1 [0153.353] CloseHandle (hObject=0x350) returned 1 [0153.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", lpFilePart=0x0) returned 0x31 [0153.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg.coom", lpFilePart=0x0) returned 0x36 [0153.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.357] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6hezlsbe7gyzeo.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6514d3c0, ftCreationTime.dwHighDateTime=0x1d81f53, ftLastAccessTime.dwLowDateTime=0x213e46e0, ftLastAccessTime.dwHighDateTime=0x1d826e7, ftLastWriteTime.dwLowDateTime=0x20412d32, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x16cc0)) returned 1 [0153.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.358] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6hezlsbe7gyzeo.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6hezlsbe7gyzeo.jpg.coom")) returned 1 [0153.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", lpFilePart=0x0) returned 0x32 [0153.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.359] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6xk8yfhyt9nwjgm.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.359] GetFileType (hFile=0x350) returned 0x1 [0153.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.359] GetFileType (hFile=0x350) returned 0x1 [0153.359] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xba29 [0153.360] ReadFile (in: hFile=0x350, lpBuffer=0x2345ea8, nNumberOfBytesToRead=0xba29, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2345ea8*, lpNumberOfBytesRead=0x19eeb0*=0xba29, lpOverlapped=0x0) returned 1 [0153.361] CloseHandle (hObject=0x350) returned 1 [0153.384] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", lpFilePart=0x0) returned 0x32 [0153.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.384] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6xk8yfhyt9nwjgm.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.386] GetFileType (hFile=0x350) returned 0x1 [0153.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.386] GetFileType (hFile=0x350) returned 0x1 [0153.386] WriteFile (in: hFile=0x350, lpBuffer=0x23b5b10*, nNumberOfBytesToWrite=0xba30, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23b5b10*, lpNumberOfBytesWritten=0x19eea0*=0xba30, lpOverlapped=0x0) returned 1 [0153.388] CloseHandle (hObject=0x350) returned 1 [0153.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", lpFilePart=0x0) returned 0x32 [0153.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg.coom", lpFilePart=0x0) returned 0x37 [0153.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6xk8yfhyt9nwjgm.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x838492a0, ftCreationTime.dwHighDateTime=0x1d82219, ftLastAccessTime.dwLowDateTime=0x17efee10, ftLastAccessTime.dwHighDateTime=0x1d826d1, ftLastWriteTime.dwLowDateTime=0x20465cb3, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xba30)) returned 1 [0153.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.391] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6xk8yfhyt9nwjgm.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6xk8yfhyt9nwjgm.jpg.coom")) returned 1 [0153.392] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", lpFilePart=0x0) returned 0x2b [0153.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.392] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8yckzqol.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.392] GetFileType (hFile=0x350) returned 0x1 [0153.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.392] GetFileType (hFile=0x350) returned 0x1 [0153.393] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xc75e [0153.393] ReadFile (in: hFile=0x350, lpBuffer=0x23c18ec, nNumberOfBytesToRead=0xc75e, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23c18ec*, lpNumberOfBytesRead=0x19eeb0*=0xc75e, lpOverlapped=0x0) returned 1 [0153.394] CloseHandle (hObject=0x350) returned 1 [0153.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", lpFilePart=0x0) returned 0x2b [0153.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.457] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8yckzqol.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.459] GetFileType (hFile=0x350) returned 0x1 [0153.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.459] GetFileType (hFile=0x350) returned 0x1 [0153.459] WriteFile (in: hFile=0x350, lpBuffer=0x2241d78*, nNumberOfBytesToWrite=0xc760, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2241d78*, lpNumberOfBytesWritten=0x19eea0*=0xc760, lpOverlapped=0x0) returned 1 [0153.461] CloseHandle (hObject=0x350) returned 1 [0153.589] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", lpFilePart=0x0) returned 0x2b [0153.590] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png.coom", lpFilePart=0x0) returned 0x30 [0153.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8yckzqol.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59967750, ftCreationTime.dwHighDateTime=0x1d824ea, ftLastAccessTime.dwLowDateTime=0x102d8670, ftLastAccessTime.dwHighDateTime=0x1d8296e, ftLastWriteTime.dwLowDateTime=0x2064aaf2, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xc760)) returned 1 [0153.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.590] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8yckzqol.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8yckzqol.png.coom")) returned 1 [0153.591] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", lpFilePart=0x0) returned 0x2a [0153.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.591] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\b4ztchi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.591] GetFileType (hFile=0x350) returned 0x1 [0153.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.591] GetFileType (hFile=0x350) returned 0x1 [0153.591] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xbdbf [0153.591] ReadFile (in: hFile=0x350, lpBuffer=0x224e854, nNumberOfBytesToRead=0xbdbf, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x224e854*, lpNumberOfBytesRead=0x19eeb0*=0xbdbf, lpOverlapped=0x0) returned 1 [0153.593] CloseHandle (hObject=0x350) returned 1 [0153.613] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", lpFilePart=0x0) returned 0x2a [0153.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.613] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\b4ztchi.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.615] GetFileType (hFile=0x350) returned 0x1 [0153.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.615] GetFileType (hFile=0x350) returned 0x1 [0153.615] WriteFile (in: hFile=0x350, lpBuffer=0x22bf0c8*, nNumberOfBytesToWrite=0xbdc0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22bf0c8*, lpNumberOfBytesWritten=0x19eea0*=0xbdc0, lpOverlapped=0x0) returned 1 [0153.617] CloseHandle (hObject=0x350) returned 1 [0153.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", lpFilePart=0x0) returned 0x2a [0153.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png.coom", lpFilePart=0x0) returned 0x2f [0153.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.620] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\b4ztchi.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f16bd0, ftCreationTime.dwHighDateTime=0x1d828f6, ftLastAccessTime.dwLowDateTime=0xd4b33690, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0x2069483f, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xbdc0)) returned 1 [0153.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.620] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\b4ztchi.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\b4ztchi.png.coom")) returned 1 [0153.621] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", lpFilePart=0x0) returned 0x2f [0153.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.621] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\bresk rqwy7z.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.622] GetFileType (hFile=0x350) returned 0x1 [0153.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.622] GetFileType (hFile=0x350) returned 0x1 [0153.622] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xa145 [0153.622] ReadFile (in: hFile=0x350, lpBuffer=0x22cb1c4, nNumberOfBytesToRead=0xa145, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22cb1c4*, lpNumberOfBytesRead=0x19eeb0*=0xa145, lpOverlapped=0x0) returned 1 [0153.624] CloseHandle (hObject=0x350) returned 1 [0153.655] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", lpFilePart=0x0) returned 0x2f [0153.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.655] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\bresk rqwy7z.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.658] GetFileType (hFile=0x350) returned 0x1 [0153.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.658] GetFileType (hFile=0x350) returned 0x1 [0153.658] WriteFile (in: hFile=0x350, lpBuffer=0x234a618*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x234a618*, lpNumberOfBytesWritten=0x19eea0*=0xa150, lpOverlapped=0x0) returned 1 [0153.661] CloseHandle (hObject=0x350) returned 1 [0153.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", lpFilePart=0x0) returned 0x2f [0153.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png.coom", lpFilePart=0x0) returned 0x34 [0153.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\bresk rqwy7z.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbebb9f0, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0xc4662480, ftLastAccessTime.dwHighDateTime=0x1d825e0, ftLastWriteTime.dwLowDateTime=0x20700063, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xa150)) returned 1 [0153.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.664] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\bresk rqwy7z.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\bresk rqwy7z.png.coom")) returned 1 [0153.665] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", lpFilePart=0x0) returned 0x2a [0153.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.668] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\brjpjfc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.669] GetFileType (hFile=0x350) returned 0x1 [0153.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.669] GetFileType (hFile=0x350) returned 0x1 [0153.669] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xc7d8 [0153.669] ReadFile (in: hFile=0x350, lpBuffer=0x2354ac4, nNumberOfBytesToRead=0xc7d8, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2354ac4*, lpNumberOfBytesRead=0x19eeb0*=0xc7d8, lpOverlapped=0x0) returned 1 [0153.670] CloseHandle (hObject=0x350) returned 1 [0153.690] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", lpFilePart=0x0) returned 0x2a [0153.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.690] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\brjpjfc.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.692] GetFileType (hFile=0x350) returned 0x1 [0153.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.692] GetFileType (hFile=0x350) returned 0x1 [0153.692] WriteFile (in: hFile=0x350, lpBuffer=0x23c7038*, nNumberOfBytesToWrite=0xc7e0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23c7038*, lpNumberOfBytesWritten=0x19eea0*=0xc7e0, lpOverlapped=0x0) returned 1 [0153.694] CloseHandle (hObject=0x350) returned 1 [0153.697] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", lpFilePart=0x0) returned 0x2a [0153.697] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png.coom", lpFilePart=0x0) returned 0x2f [0153.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.697] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\brjpjfc.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528f0920, ftCreationTime.dwHighDateTime=0x1d81c40, ftLastAccessTime.dwLowDateTime=0xe0b75bb0, ftLastAccessTime.dwHighDateTime=0x1d8284f, ftLastWriteTime.dwLowDateTime=0x20751ffd, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xc7e0)) returned 1 [0153.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.698] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\brjpjfc.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\brjpjfc.png.coom")) returned 1 [0153.698] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", lpFilePart=0x0) returned 0x2f [0153.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.698] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\d-xnpctgc1q9.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.699] GetFileType (hFile=0x350) returned 0x1 [0153.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.699] GetFileType (hFile=0x350) returned 0x1 [0153.699] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x3a23 [0153.699] ReadFile (in: hFile=0x350, lpBuffer=0x23d3b54, nNumberOfBytesToRead=0x3a23, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23d3b54*, lpNumberOfBytesRead=0x19eeb0*=0x3a23, lpOverlapped=0x0) returned 1 [0153.700] CloseHandle (hObject=0x350) returned 1 [0153.762] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", lpFilePart=0x0) returned 0x2f [0153.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.762] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\d-xnpctgc1q9.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.764] GetFileType (hFile=0x350) returned 0x1 [0153.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.764] GetFileType (hFile=0x350) returned 0x1 [0153.764] WriteFile (in: hFile=0x350, lpBuffer=0x2236a30*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2236a30*, lpNumberOfBytesWritten=0x19eea0*=0x3a30, lpOverlapped=0x0) returned 1 [0153.765] CloseHandle (hObject=0x350) returned 1 [0153.767] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", lpFilePart=0x0) returned 0x2f [0153.767] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png.coom", lpFilePart=0x0) returned 0x34 [0153.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\d-xnpctgc1q9.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fa0300, ftCreationTime.dwHighDateTime=0x1d82618, ftLastAccessTime.dwLowDateTime=0xcd9fa800, ftLastAccessTime.dwHighDateTime=0x1d82973, ftLastWriteTime.dwLowDateTime=0x207fbc37, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x3a30)) returned 1 [0153.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.767] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\d-xnpctgc1q9.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\d-xnpctgc1q9.png.coom")) returned 1 [0153.768] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", lpFilePart=0x0) returned 0x2a [0153.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.768] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gsikafh.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.768] GetFileType (hFile=0x350) returned 0x1 [0153.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.768] GetFileType (hFile=0x350) returned 0x1 [0153.768] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x107e2 [0153.769] ReadFile (in: hFile=0x350, lpBuffer=0x223a7ec, nNumberOfBytesToRead=0x107e2, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x223a7ec*, lpNumberOfBytesRead=0x19eeb0*=0x107e2, lpOverlapped=0x0) returned 1 [0153.770] CloseHandle (hObject=0x350) returned 1 [0153.802] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", lpFilePart=0x0) returned 0x2a [0153.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.802] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gsikafh.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.805] GetFileType (hFile=0x350) returned 0x1 [0153.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.805] GetFileType (hFile=0x350) returned 0x1 [0153.805] WriteFile (in: hFile=0x350, lpBuffer=0x22b8ef0*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22b8ef0*, lpNumberOfBytesWritten=0x19eea0*=0x107f0, lpOverlapped=0x0) returned 1 [0153.809] CloseHandle (hObject=0x350) returned 1 [0153.813] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", lpFilePart=0x0) returned 0x2a [0153.813] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp.coom", lpFilePart=0x0) returned 0x2f [0153.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.813] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gsikafh.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f6f0a0, ftCreationTime.dwHighDateTime=0x1d8227b, ftLastAccessTime.dwLowDateTime=0x17e3bb80, ftLastAccessTime.dwHighDateTime=0x1d828b2, ftLastWriteTime.dwLowDateTime=0x2086b12a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x107f0)) returned 1 [0153.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.813] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gsikafh.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gsikafh.bmp.coom")) returned 1 [0153.815] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", lpFilePart=0x0) returned 0x2f [0153.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.816] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gxgbf6roc6lb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.816] GetFileType (hFile=0x350) returned 0x1 [0153.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.816] GetFileType (hFile=0x350) returned 0x1 [0153.816] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x17783 [0153.816] ReadFile (in: hFile=0x350, lpBuffer=0x345dd60, nNumberOfBytesToRead=0x17783, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x345dd60*, lpNumberOfBytesRead=0x19eeb0*=0x17783, lpOverlapped=0x0) returned 1 [0153.818] CloseHandle (hObject=0x350) returned 1 [0153.861] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", lpFilePart=0x0) returned 0x2f [0153.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.861] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gxgbf6roc6lb.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.867] GetFileType (hFile=0x350) returned 0x1 [0153.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.867] GetFileType (hFile=0x350) returned 0x1 [0153.867] WriteFile (in: hFile=0x350, lpBuffer=0x351ef60*, nNumberOfBytesToWrite=0x17790, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x351ef60*, lpNumberOfBytesWritten=0x19eea0*=0x17790, lpOverlapped=0x0) returned 1 [0153.870] CloseHandle (hObject=0x350) returned 1 [0153.874] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", lpFilePart=0x0) returned 0x2f [0153.874] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg.coom", lpFilePart=0x0) returned 0x34 [0153.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gxgbf6roc6lb.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b7400, ftCreationTime.dwHighDateTime=0x1d81d2b, ftLastAccessTime.dwLowDateTime=0xdec8e540, ftLastAccessTime.dwHighDateTime=0x1d82867, ftLastWriteTime.dwLowDateTime=0x2090264f, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17790)) returned 1 [0153.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.875] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gxgbf6roc6lb.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gxgbf6roc6lb.jpg.coom")) returned 1 [0153.876] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", lpFilePart=0x0) returned 0x2b [0153.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.876] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\hlxiniph.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.876] GetFileType (hFile=0x350) returned 0x1 [0153.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.877] GetFileType (hFile=0x350) returned 0x1 [0153.877] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1391a [0153.877] ReadFile (in: hFile=0x350, lpBuffer=0x2316b50, nNumberOfBytesToRead=0x1391a, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2316b50*, lpNumberOfBytesRead=0x19eeb0*=0x1391a, lpOverlapped=0x0) returned 1 [0153.879] CloseHandle (hObject=0x350) returned 1 [0153.932] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", lpFilePart=0x0) returned 0x2b [0153.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.932] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\hlxiniph.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.934] GetFileType (hFile=0x350) returned 0x1 [0153.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0153.934] GetFileType (hFile=0x350) returned 0x1 [0153.934] WriteFile (in: hFile=0x350, lpBuffer=0x21ed974*, nNumberOfBytesToWrite=0x13920, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x21ed974*, lpNumberOfBytesWritten=0x19eea0*=0x13920, lpOverlapped=0x0) returned 1 [0153.937] CloseHandle (hObject=0x350) returned 1 [0153.940] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", lpFilePart=0x0) returned 0x2b [0153.940] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp.coom", lpFilePart=0x0) returned 0x30 [0153.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0153.940] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\hlxiniph.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7daed200, ftCreationTime.dwHighDateTime=0x1d827e6, ftLastAccessTime.dwLowDateTime=0xe2a8d900, ftLastAccessTime.dwHighDateTime=0x1d8282f, ftLastWriteTime.dwLowDateTime=0x209a34dc, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13920)) returned 1 [0153.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0153.941] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\hlxiniph.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\hlxiniph.bmp.coom")) returned 1 [0153.941] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", lpFilePart=0x0) returned 0x2d [0153.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0153.941] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i6fm_t84se.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0153.943] GetFileType (hFile=0x350) returned 0x1 [0153.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0153.943] GetFileType (hFile=0x350) returned 0x1 [0153.943] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x9c9e [0153.943] ReadFile (in: hFile=0x350, lpBuffer=0x22015d4, nNumberOfBytesToRead=0x9c9e, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22015d4*, lpNumberOfBytesRead=0x19eeb0*=0x9c9e, lpOverlapped=0x0) returned 1 [0153.944] CloseHandle (hObject=0x350) returned 1 [0153.998] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", lpFilePart=0x0) returned 0x2d [0153.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0153.999] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i6fm_t84se.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.001] GetFileType (hFile=0x350) returned 0x1 [0154.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0154.001] GetFileType (hFile=0x350) returned 0x1 [0154.001] WriteFile (in: hFile=0x350, lpBuffer=0x227f414*, nNumberOfBytesToWrite=0x9ca0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x227f414*, lpNumberOfBytesWritten=0x19eea0*=0x9ca0, lpOverlapped=0x0) returned 1 [0154.003] CloseHandle (hObject=0x350) returned 1 [0154.006] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", lpFilePart=0x0) returned 0x2d [0154.006] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png.coom", lpFilePart=0x0) returned 0x32 [0154.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0154.006] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i6fm_t84se.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dce0530, ftCreationTime.dwHighDateTime=0x1d826a6, ftLastAccessTime.dwLowDateTime=0x646692d0, ftLastAccessTime.dwHighDateTime=0x1d8289d, ftLastWriteTime.dwLowDateTime=0x20a42a38, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x9ca0)) returned 1 [0154.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0154.006] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i6fm_t84se.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i6fm_t84se.png.coom")) returned 1 [0154.007] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", lpFilePart=0x0) returned 0x30 [0154.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0154.007] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ivsui27svr1y3.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.007] GetFileType (hFile=0x350) returned 0x1 [0154.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0154.008] GetFileType (hFile=0x350) returned 0x1 [0154.008] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x16d5c [0154.009] ReadFile (in: hFile=0x350, lpBuffer=0x3209090, nNumberOfBytesToRead=0x16d5c, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3209090*, lpNumberOfBytesRead=0x19eeb0*=0x16d5c, lpOverlapped=0x0) returned 1 [0154.012] CloseHandle (hObject=0x350) returned 1 [0154.046] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", lpFilePart=0x0) returned 0x30 [0154.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0154.046] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ivsui27svr1y3.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.048] GetFileType (hFile=0x350) returned 0x1 [0154.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0154.048] GetFileType (hFile=0x350) returned 0x1 [0154.048] WriteFile (in: hFile=0x350, lpBuffer=0x327b3a8*, nNumberOfBytesToWrite=0x16d60, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x327b3a8*, lpNumberOfBytesWritten=0x19eea0*=0x16d60, lpOverlapped=0x0) returned 1 [0154.051] CloseHandle (hObject=0x350) returned 1 [0154.055] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", lpFilePart=0x0) returned 0x30 [0154.055] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg.coom", lpFilePart=0x0) returned 0x35 [0154.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0154.056] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ivsui27svr1y3.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde0b0ec0, ftCreationTime.dwHighDateTime=0x1d8258e, ftLastAccessTime.dwLowDateTime=0x2e000b40, ftLastAccessTime.dwHighDateTime=0x1d82910, ftLastWriteTime.dwLowDateTime=0x20abc362, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x16d60)) returned 1 [0154.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0154.056] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ivsui27svr1y3.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ivsui27svr1y3.jpg.coom")) returned 1 [0154.057] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", lpFilePart=0x0) returned 0x34 [0154.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0154.057] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lsoqhqon27oebzqi8.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.057] GetFileType (hFile=0x350) returned 0x1 [0154.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0154.057] GetFileType (hFile=0x350) returned 0x1 [0154.057] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x13230 [0154.058] ReadFile (in: hFile=0x350, lpBuffer=0x22d6598, nNumberOfBytesToRead=0x13230, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22d6598*, lpNumberOfBytesRead=0x19eeb0*=0x13230, lpOverlapped=0x0) returned 1 [0154.060] CloseHandle (hObject=0x350) returned 1 [0154.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", lpFilePart=0x0) returned 0x34 [0154.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0154.147] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lsoqhqon27oebzqi8.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.148] GetFileType (hFile=0x350) returned 0x1 [0154.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0154.149] GetFileType (hFile=0x350) returned 0x1 [0154.149] WriteFile (in: hFile=0x350, lpBuffer=0x235ca2c*, nNumberOfBytesToWrite=0x13240, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x235ca2c*, lpNumberOfBytesWritten=0x19eea0*=0x13240, lpOverlapped=0x0) returned 1 [0154.151] CloseHandle (hObject=0x350) returned 1 [0154.155] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", lpFilePart=0x0) returned 0x34 [0154.155] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg.coom", lpFilePart=0x0) returned 0x39 [0154.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0154.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lsoqhqon27oebzqi8.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16116470, ftCreationTime.dwHighDateTime=0x1d8200a, ftLastAccessTime.dwLowDateTime=0x96f1bb50, ftLastAccessTime.dwHighDateTime=0x1d825c1, ftLastWriteTime.dwLowDateTime=0x20bae72e, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13240)) returned 1 [0154.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0154.157] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lsoqhqon27oebzqi8.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lsoqhqon27oebzqi8.jpg.coom")) returned 1 [0154.158] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", lpFilePart=0x0) returned 0x2c [0154.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0154.158] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mi45qg6wk.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.159] GetFileType (hFile=0x350) returned 0x1 [0154.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0154.159] GetFileType (hFile=0x350) returned 0x1 [0154.159] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x12837 [0154.159] ReadFile (in: hFile=0x350, lpBuffer=0x2370018, nNumberOfBytesToRead=0x12837, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2370018*, lpNumberOfBytesRead=0x19eeb0*=0x12837, lpOverlapped=0x0) returned 1 [0154.161] CloseHandle (hObject=0x350) returned 1 [0154.307] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", lpFilePart=0x0) returned 0x2c [0154.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0154.307] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mi45qg6wk.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.309] GetFileType (hFile=0x350) returned 0x1 [0154.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0154.309] GetFileType (hFile=0x350) returned 0x1 [0154.309] WriteFile (in: hFile=0x350, lpBuffer=0x21edaf0*, nNumberOfBytesToWrite=0x12840, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x21edaf0*, lpNumberOfBytesWritten=0x19eea0*=0x12840, lpOverlapped=0x0) returned 1 [0154.311] CloseHandle (hObject=0x350) returned 1 [0154.315] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", lpFilePart=0x0) returned 0x2c [0154.315] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp.coom", lpFilePart=0x0) returned 0x31 [0154.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0154.315] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mi45qg6wk.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb95b0, ftCreationTime.dwHighDateTime=0x1d821be, ftLastAccessTime.dwLowDateTime=0x866ed1f0, ftLastAccessTime.dwHighDateTime=0x1d82274, ftLastWriteTime.dwLowDateTime=0x20d361b0, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x12840)) returned 1 [0154.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0154.315] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mi45qg6wk.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mi45qg6wk.bmp.coom")) returned 1 [0154.317] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", lpFilePart=0x0) returned 0x2e [0154.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0154.317] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mjal9vxiet_.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.317] GetFileType (hFile=0x350) returned 0x1 [0154.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0154.317] GetFileType (hFile=0x350) returned 0x1 [0154.317] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x131f2 [0154.317] ReadFile (in: hFile=0x350, lpBuffer=0x220067c, nNumberOfBytesToRead=0x131f2, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x220067c*, lpNumberOfBytesRead=0x19eeb0*=0x131f2, lpOverlapped=0x0) returned 1 [0154.319] CloseHandle (hObject=0x350) returned 1 [0154.447] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", lpFilePart=0x0) returned 0x2e [0154.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0154.448] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mjal9vxiet_.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.450] GetFileType (hFile=0x350) returned 0x1 [0154.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0154.450] GetFileType (hFile=0x350) returned 0x1 [0154.450] WriteFile (in: hFile=0x350, lpBuffer=0x2286bb0*, nNumberOfBytesToWrite=0x13200, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2286bb0*, lpNumberOfBytesWritten=0x19eea0*=0x13200, lpOverlapped=0x0) returned 1 [0154.455] CloseHandle (hObject=0x350) returned 1 [0154.461] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", lpFilePart=0x0) returned 0x2e [0154.461] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg.coom", lpFilePart=0x0) returned 0x33 [0154.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0154.461] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mjal9vxiet_.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17995170, ftCreationTime.dwHighDateTime=0x1d81df0, ftLastAccessTime.dwLowDateTime=0x310f83c0, ftLastAccessTime.dwHighDateTime=0x1d81e10, ftLastWriteTime.dwLowDateTime=0x20e9a564, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13200)) returned 1 [0154.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0154.462] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mjal9vxiet_.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mjal9vxiet_.jpg.coom")) returned 1 [0154.463] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", lpFilePart=0x0) returned 0x29 [0154.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0154.463] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nlit5d.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.463] GetFileType (hFile=0x350) returned 0x1 [0154.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0154.463] GetFileType (hFile=0x350) returned 0x1 [0154.463] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xc88d [0154.464] ReadFile (in: hFile=0x350, lpBuffer=0x229a114, nNumberOfBytesToRead=0xc88d, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x229a114*, lpNumberOfBytesRead=0x19eeb0*=0xc88d, lpOverlapped=0x0) returned 1 [0154.466] CloseHandle (hObject=0x350) returned 1 [0154.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", lpFilePart=0x0) returned 0x29 [0154.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0154.505] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nlit5d.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.507] GetFileType (hFile=0x350) returned 0x1 [0154.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0154.507] GetFileType (hFile=0x350) returned 0x1 [0154.507] WriteFile (in: hFile=0x350, lpBuffer=0x230c89c*, nNumberOfBytesToWrite=0xc890, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x230c89c*, lpNumberOfBytesWritten=0x19eea0*=0xc890, lpOverlapped=0x0) returned 1 [0154.512] CloseHandle (hObject=0x350) returned 1 [0154.516] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", lpFilePart=0x0) returned 0x29 [0154.516] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp.coom", lpFilePart=0x0) returned 0x2e [0154.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0154.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nlit5d.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf90a3270, ftCreationTime.dwHighDateTime=0x1d81d94, ftLastAccessTime.dwLowDateTime=0xdbb79470, ftLastAccessTime.dwHighDateTime=0x1d81f91, ftLastWriteTime.dwLowDateTime=0x20f20767, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xc890)) returned 1 [0154.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0154.517] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nlit5d.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nlit5d.bmp.coom")) returned 1 [0154.517] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", lpFilePart=0x0) returned 0x32 [0154.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0154.518] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\prgqydqfetzpsuf.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.518] GetFileType (hFile=0x350) returned 0x1 [0154.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0154.518] GetFileType (hFile=0x350) returned 0x1 [0154.518] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x2400 [0154.518] ReadFile (in: hFile=0x350, lpBuffer=0x231946c, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x231946c*, lpNumberOfBytesRead=0x19eeb0*=0x2400, lpOverlapped=0x0) returned 1 [0154.519] CloseHandle (hObject=0x350) returned 1 [0154.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", lpFilePart=0x0) returned 0x32 [0154.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0154.726] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\prgqydqfetzpsuf.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.728] GetFileType (hFile=0x350) returned 0x1 [0154.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0154.728] GetFileType (hFile=0x350) returned 0x1 [0154.728] WriteFile (in: hFile=0x350, lpBuffer=0x237167c*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x237167c*, lpNumberOfBytesWritten=0x19eea0*=0x2410, lpOverlapped=0x0) returned 1 [0154.729] CloseHandle (hObject=0x350) returned 1 [0154.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", lpFilePart=0x0) returned 0x32 [0154.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp.coom", lpFilePart=0x0) returned 0x37 [0154.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0154.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\prgqydqfetzpsuf.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4844e550, ftCreationTime.dwHighDateTime=0x1d81ae4, ftLastAccessTime.dwLowDateTime=0xe15bdb00, ftLastAccessTime.dwHighDateTime=0x1d81f39, ftLastWriteTime.dwLowDateTime=0x2112d0ce, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x2410)) returned 1 [0154.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0154.731] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\prgqydqfetzpsuf.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\prgqydqfetzpsuf.bmp.coom")) returned 1 [0154.732] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", lpFilePart=0x0) returned 0x27 [0154.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0154.732] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\srpt.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.732] GetFileType (hFile=0x350) returned 0x1 [0154.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0154.732] GetFileType (hFile=0x350) returned 0x1 [0154.732] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x6992 [0154.732] ReadFile (in: hFile=0x350, lpBuffer=0x2373df8, nNumberOfBytesToRead=0x6992, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2373df8*, lpNumberOfBytesRead=0x19eeb0*=0x6992, lpOverlapped=0x0) returned 1 [0154.734] CloseHandle (hObject=0x350) returned 1 [0154.833] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", lpFilePart=0x0) returned 0x27 [0154.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0154.833] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\srpt.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.834] GetFileType (hFile=0x350) returned 0x1 [0154.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0154.835] GetFileType (hFile=0x350) returned 0x1 [0154.835] WriteFile (in: hFile=0x350, lpBuffer=0x23e1bdc*, nNumberOfBytesToWrite=0x69a0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23e1bdc*, lpNumberOfBytesWritten=0x19eea0*=0x69a0, lpOverlapped=0x0) returned 1 [0154.836] CloseHandle (hObject=0x350) returned 1 [0154.839] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", lpFilePart=0x0) returned 0x27 [0154.839] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp.coom", lpFilePart=0x0) returned 0x2c [0154.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0154.839] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\srpt.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1906ebb0, ftCreationTime.dwHighDateTime=0x1d82676, ftLastAccessTime.dwLowDateTime=0xa2a90710, ftLastAccessTime.dwHighDateTime=0x1d829b7, ftLastWriteTime.dwLowDateTime=0x21233906, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x69a0)) returned 1 [0154.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0154.839] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\srpt.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\srpt.bmp.coom")) returned 1 [0154.840] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", lpFilePart=0x0) returned 0x2c [0154.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0154.841] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sszyckq2_.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.841] GetFileType (hFile=0x350) returned 0x1 [0154.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0154.841] GetFileType (hFile=0x350) returned 0x1 [0154.841] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x6ebb [0154.841] ReadFile (in: hFile=0x350, lpBuffer=0x23e8890, nNumberOfBytesToRead=0x6ebb, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23e8890*, lpNumberOfBytesRead=0x19eeb0*=0x6ebb, lpOverlapped=0x0) returned 1 [0154.843] CloseHandle (hObject=0x350) returned 1 [0154.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", lpFilePart=0x0) returned 0x2c [0154.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0154.907] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sszyckq2_.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.909] GetFileType (hFile=0x350) returned 0x1 [0154.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0154.909] GetFileType (hFile=0x350) returned 0x1 [0154.909] WriteFile (in: hFile=0x350, lpBuffer=0x225be5c*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x225be5c*, lpNumberOfBytesWritten=0x19eea0*=0x6ec0, lpOverlapped=0x0) returned 1 [0154.910] CloseHandle (hObject=0x350) returned 1 [0154.912] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", lpFilePart=0x0) returned 0x2c [0154.913] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png.coom", lpFilePart=0x0) returned 0x31 [0154.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0154.913] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sszyckq2_.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae76680, ftCreationTime.dwHighDateTime=0x1d827e5, ftLastAccessTime.dwLowDateTime=0xfb7a2390, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x212e8b05, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x6ec0)) returned 1 [0154.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0154.920] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sszyckq2_.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sszyckq2_.png.coom")) returned 1 [0154.921] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", lpFilePart=0x0) returned 0x31 [0154.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0154.921] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sy8zc6o0w2dpzb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.922] GetFileType (hFile=0x350) returned 0x1 [0154.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0154.922] GetFileType (hFile=0x350) returned 0x1 [0154.922] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x40be [0154.922] ReadFile (in: hFile=0x350, lpBuffer=0x2263074, nNumberOfBytesToRead=0x40be, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2263074*, lpNumberOfBytesRead=0x19eeb0*=0x40be, lpOverlapped=0x0) returned 1 [0154.925] CloseHandle (hObject=0x350) returned 1 [0154.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", lpFilePart=0x0) returned 0x31 [0154.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0154.953] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sy8zc6o0w2dpzb.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.958] GetFileType (hFile=0x350) returned 0x1 [0154.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0154.958] GetFileType (hFile=0x350) returned 0x1 [0154.958] WriteFile (in: hFile=0x350, lpBuffer=0x22c4354*, nNumberOfBytesToWrite=0x40c0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22c4354*, lpNumberOfBytesWritten=0x19eea0*=0x40c0, lpOverlapped=0x0) returned 1 [0154.960] CloseHandle (hObject=0x350) returned 1 [0154.962] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", lpFilePart=0x0) returned 0x31 [0154.962] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg.coom", lpFilePart=0x0) returned 0x36 [0154.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0154.962] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sy8zc6o0w2dpzb.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5cf6670, ftCreationTime.dwHighDateTime=0x1d81baa, ftLastAccessTime.dwLowDateTime=0x4a155b70, ftLastAccessTime.dwHighDateTime=0x1d823eb, ftLastWriteTime.dwLowDateTime=0x21361855, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x40c0)) returned 1 [0154.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0154.962] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sy8zc6o0w2dpzb.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sy8zc6o0w2dpzb.jpg.coom")) returned 1 [0154.967] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", lpFilePart=0x0) returned 0x36 [0154.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0154.967] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\thhlqm_vxfrhakjgqh4.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0154.968] GetFileType (hFile=0x350) returned 0x1 [0154.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0154.968] GetFileType (hFile=0x350) returned 0x1 [0154.968] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x14dce [0154.969] ReadFile (in: hFile=0x350, lpBuffer=0x331cb48, nNumberOfBytesToRead=0x14dce, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x331cb48*, lpNumberOfBytesRead=0x19eeb0*=0x14dce, lpOverlapped=0x0) returned 1 [0154.972] CloseHandle (hObject=0x350) returned 1 [0155.013] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", lpFilePart=0x0) returned 0x36 [0155.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0155.013] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\thhlqm_vxfrhakjgqh4.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0155.015] GetFileType (hFile=0x350) returned 0x1 [0155.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0155.015] GetFileType (hFile=0x350) returned 0x1 [0155.016] WriteFile (in: hFile=0x350, lpBuffer=0x3385098*, nNumberOfBytesToWrite=0x14dd0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3385098*, lpNumberOfBytesWritten=0x19eea0*=0x14dd0, lpOverlapped=0x0) returned 1 [0155.019] CloseHandle (hObject=0x350) returned 1 [0155.023] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", lpFilePart=0x0) returned 0x36 [0155.023] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp.coom", lpFilePart=0x0) returned 0x3b [0155.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0155.023] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\thhlqm_vxfrhakjgqh4.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea8680, ftCreationTime.dwHighDateTime=0x1d81c3d, ftLastAccessTime.dwLowDateTime=0x53695f10, ftLastAccessTime.dwHighDateTime=0x1d8228c, ftLastWriteTime.dwLowDateTime=0x213f62d8, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x14dd0)) returned 1 [0155.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0155.023] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\thhlqm_vxfrhakjgqh4.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\thhlqm_vxfrhakjgqh4.bmp.coom")) returned 1 [0155.024] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", lpFilePart=0x0) returned 0x34 [0155.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0155.025] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\tq-yo c2w6tz7vngz.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0155.025] GetFileType (hFile=0x350) returned 0x1 [0155.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0155.028] GetFileType (hFile=0x350) returned 0x1 [0155.028] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xc6cc [0155.028] ReadFile (in: hFile=0x350, lpBuffer=0x2315944, nNumberOfBytesToRead=0xc6cc, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2315944*, lpNumberOfBytesRead=0x19eeb0*=0xc6cc, lpOverlapped=0x0) returned 1 [0155.030] CloseHandle (hObject=0x350) returned 1 [0155.060] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", lpFilePart=0x0) returned 0x34 [0155.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0155.060] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\tq-yo c2w6tz7vngz.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0155.062] GetFileType (hFile=0x350) returned 0x1 [0155.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0155.063] GetFileType (hFile=0x350) returned 0x1 [0155.063] WriteFile (in: hFile=0x350, lpBuffer=0x2387b88*, nNumberOfBytesToWrite=0xc6d0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2387b88*, lpNumberOfBytesWritten=0x19eea0*=0xc6d0, lpOverlapped=0x0) returned 1 [0155.068] CloseHandle (hObject=0x350) returned 1 [0155.071] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", lpFilePart=0x0) returned 0x34 [0155.071] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp.coom", lpFilePart=0x0) returned 0x39 [0155.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0155.071] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\tq-yo c2w6tz7vngz.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dd84b0, ftCreationTime.dwHighDateTime=0x1d81f2c, ftLastAccessTime.dwLowDateTime=0xb3842800, ftLastAccessTime.dwHighDateTime=0x1d8228f, ftLastWriteTime.dwLowDateTime=0x2146b5dc, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xc6d0)) returned 1 [0155.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0155.071] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\tq-yo c2w6tz7vngz.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\tq-yo c2w6tz7vngz.bmp.coom")) returned 1 [0155.072] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", lpFilePart=0x0) returned 0x32 [0155.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0155.072] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\vmb og1vu5v_pxk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0155.072] GetFileType (hFile=0x350) returned 0x1 [0155.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0155.073] GetFileType (hFile=0x350) returned 0x1 [0155.073] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xd60 [0155.073] ReadFile (in: hFile=0x350, lpBuffer=0x2395370, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2395370*, lpNumberOfBytesRead=0x19eeb0*=0xd60, lpOverlapped=0x0) returned 1 [0155.074] CloseHandle (hObject=0x350) returned 1 [0155.225] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", lpFilePart=0x0) returned 0x32 [0155.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0155.225] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\vmb og1vu5v_pxk.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0155.227] GetFileType (hFile=0x350) returned 0x1 [0155.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0155.227] GetFileType (hFile=0x350) returned 0x1 [0155.227] WriteFile (in: hFile=0x350, lpBuffer=0x23e7580*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x19ee74, lpOverlapped=0x0 | out: lpBuffer=0x23e7580*, lpNumberOfBytesWritten=0x19ee74*=0xd70, lpOverlapped=0x0) returned 1 [0155.229] CloseHandle (hObject=0x350) returned 1 [0155.230] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", lpFilePart=0x0) returned 0x32 [0155.230] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png.coom", lpFilePart=0x0) returned 0x37 [0155.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0155.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\vmb og1vu5v_pxk.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa9b3c0, ftCreationTime.dwHighDateTime=0x1d81d89, ftLastAccessTime.dwLowDateTime=0x66c4d260, ftLastAccessTime.dwHighDateTime=0x1d822f0, ftLastWriteTime.dwLowDateTime=0x215f0cc3, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xd70)) returned 1 [0155.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0155.231] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\vmb og1vu5v_pxk.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\vmb og1vu5v_pxk.png.coom")) returned 1 [0155.232] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", lpFilePart=0x0) returned 0x32 [0155.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0155.232] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\zfatyxdgq7tzjo4.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0155.232] GetFileType (hFile=0x350) returned 0x1 [0155.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0155.232] GetFileType (hFile=0x350) returned 0x1 [0155.232] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x28b2 [0155.232] ReadFile (in: hFile=0x350, lpBuffer=0x23e885c, nNumberOfBytesToRead=0x28b2, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23e885c*, lpNumberOfBytesRead=0x19eeb0*=0x28b2, lpOverlapped=0x0) returned 1 [0155.234] CloseHandle (hObject=0x350) returned 1 [0155.322] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", lpFilePart=0x0) returned 0x32 [0155.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0155.323] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\zfatyxdgq7tzjo4.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0155.325] GetFileType (hFile=0x350) returned 0x1 [0155.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0155.325] GetFileType (hFile=0x350) returned 0x1 [0155.325] WriteFile (in: hFile=0x350, lpBuffer=0x2252c34*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2252c34*, lpNumberOfBytesWritten=0x19eea0*=0x28c0, lpOverlapped=0x0) returned 1 [0155.326] CloseHandle (hObject=0x350) returned 1 [0155.328] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", lpFilePart=0x0) returned 0x32 [0155.328] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp.coom", lpFilePart=0x0) returned 0x37 [0155.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0155.328] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\zfatyxdgq7tzjo4.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3ae720, ftCreationTime.dwHighDateTime=0x1d820f5, ftLastAccessTime.dwLowDateTime=0x88ac5290, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0x216deeb5, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x28c0)) returned 1 [0155.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0155.328] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\zfatyxdgq7tzjo4.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\zfatyxdgq7tzjo4.bmp.coom")) returned 1 [0155.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", lpFilePart=0x0) returned 0x2c [0155.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1 [0155.329] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_lbbor qp.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0155.329] GetFileType (hFile=0x350) returned 0x1 [0155.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1 [0155.330] GetFileType (hFile=0x350) returned 0x1 [0155.330] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x6c49 [0155.330] ReadFile (in: hFile=0x350, lpBuffer=0x2255874, nNumberOfBytesToRead=0x6c49, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2255874*, lpNumberOfBytesRead=0x19eeb0*=0x6c49, lpOverlapped=0x0) returned 1 [0155.331] CloseHandle (hObject=0x350) returned 1 [0155.371] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", lpFilePart=0x0) returned 0x2c [0155.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1 [0155.371] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_lbbor qp.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350 [0155.373] GetFileType (hFile=0x350) returned 0x1 [0155.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1 [0155.373] GetFileType (hFile=0x350) returned 0x1 [0155.373] WriteFile (in: hFile=0x350, lpBuffer=0x22c4524*, nNumberOfBytesToWrite=0x6c50, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22c4524*, lpNumberOfBytesWritten=0x19eea0*=0x6c50, lpOverlapped=0x0) returned 1 [0155.376] CloseHandle (hObject=0x350) returned 1 [0155.378] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", lpFilePart=0x0) returned 0x2c [0155.378] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp.coom", lpFilePart=0x0) returned 0x31 [0155.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1 [0155.379] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_lbbor qp.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df1b940, ftCreationTime.dwHighDateTime=0x1d819db, ftLastAccessTime.dwLowDateTime=0x2ff12ab0, ftLastAccessTime.dwHighDateTime=0x1d81ccc, ftLastWriteTime.dwLowDateTime=0x2175a2b9, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x6c50)) returned 1 [0155.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1 [0155.379] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_lbbor qp.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_lbbor qp.bmp.coom")) returned 1 [0155.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0155.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a [0155.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", lpFilePart=0x0) returned 0x2b [0155.382] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6904e0 [0155.383] FindNextFileW (in: hFindFile=0x6904e0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.384] FindNextFileW (in: hFindFile=0x6904e0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0155.384] FindNextFileW (in: hFindFile=0x6904e0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.384] FindClose (in: hFindFile=0x6904e0 | out: hFindFile=0x6904e0) returned 1 [0155.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1 [0155.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1 [0155.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0155.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a [0155.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", lpFilePart=0x0) returned 0x2b [0155.385] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690920 [0155.385] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.386] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0155.386] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0155.386] FindClose (in: hFindFile=0x690920 | out: hFindFile=0x690920) returned 1 [0155.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1 [0155.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1 [0155.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0155.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x2d [0155.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", lpFilePart=0x0) returned 0x2e [0155.387] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6908a0 [0155.388] FindNextFileW (in: hFindFile=0x6908a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.388] FindNextFileW (in: hFindFile=0x6908a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0155.389] FindNextFileW (in: hFindFile=0x6908a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.389] FindClose (in: hFindFile=0x6908a0 | out: hFindFile=0x6908a0) returned 1 [0155.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1 [0155.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1 [0155.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1 [0155.389] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x2d [0155.389] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", lpFilePart=0x0) returned 0x2e [0155.389] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6909a0 [0155.389] FindNextFileW (in: hFindFile=0x6909a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.390] FindNextFileW (in: hFindFile=0x6909a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0155.390] FindNextFileW (in: hFindFile=0x6909a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0155.390] FindClose (in: hFindFile=0x6909a0 | out: hFindFile=0x6909a0) returned 1 [0155.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1 [0155.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1 [0155.425] GetACP () returned 0x4e4 [0155.800] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19e828, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0155.800] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", nBufferLength=0x105, lpBuffer=0x19e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", lpFilePart=0x0) returned 0x3a [0155.800] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", nBufferLength=0x105, lpBuffer=0x19e7e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", lpFilePart=0x0) returned 0x3a [0156.288] GetCurrentProcess () returned 0xffffffff [0156.288] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb9c | out: TokenHandle=0x19eb9c*=0x34c) returned 1 [0156.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0156.298] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb9c | out: lpFileInformation=0x19eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0156.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e644, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0156.300] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb9c | out: lpFileInformation=0x19eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0156.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0156.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eac8) returned 1 [0156.301] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x348 [0156.301] GetFileType (hFile=0x348) returned 0x1 [0156.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eac4) returned 1 [0156.301] GetFileType (hFile=0x348) returned 0x1 [0156.343] GetFileSize (in: hFile=0x348, lpFileSizeHigh=0x19eb90 | out: lpFileSizeHigh=0x19eb90*=0x0) returned 0x8c8f [0156.343] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eb4c, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19eb4c*=0x1000, lpOverlapped=0x0) returned 1 [0156.364] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e9e8, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e9e8*=0x1000, lpOverlapped=0x0) returned 1 [0156.371] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e89c, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e89c*=0x1000, lpOverlapped=0x0) returned 1 [0156.372] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e89c, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e89c*=0x1000, lpOverlapped=0x0) returned 1 [0156.372] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e89c, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e89c*=0x1000, lpOverlapped=0x0) returned 1 [0156.372] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e7d4, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e7d4*=0x1000, lpOverlapped=0x0) returned 1 [0156.383] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e950, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e950*=0x1000, lpOverlapped=0x0) returned 1 [0156.386] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e864, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e864*=0x1000, lpOverlapped=0x0) returned 1 [0156.386] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e864, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e864*=0xc8f, lpOverlapped=0x0) returned 1 [0156.386] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e924*=0x0, lpOverlapped=0x0) returned 1 [0156.387] CloseHandle (hObject=0x348) returned 1 [0156.389] GetCurrentProcess () returned 0xffffffff [0156.389] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ecc4 | out: TokenHandle=0x19ecc4*=0x348) returned 1 [0156.389] GetCurrentProcess () returned 0xffffffff [0156.389] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ecc4 | out: TokenHandle=0x19ecc4*=0x354) returned 1 [0156.390] GetCurrentProcess () returned 0xffffffff [0156.390] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb9c | out: TokenHandle=0x19eb9c*=0x358) returned 1 [0156.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb9c | out: lpFileInformation=0x19eb9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0156.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", nBufferLength=0x105, lpBuffer=0x19e644, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", lpFilePart=0x0) returned 0x3a [0156.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb9c | out: lpFileInformation=0x19eb9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0156.392] GetCurrentProcess () returned 0xffffffff [0156.392] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ecc4 | out: TokenHandle=0x19ecc4*=0x35c) returned 1 [0156.392] GetCurrentProcess () returned 0xffffffff [0156.392] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ecc4 | out: TokenHandle=0x19ecc4*=0x360) returned 1 [0156.412] GetCurrentProcess () returned 0xffffffff [0156.412] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea88 | out: TokenHandle=0x19ea88*=0x364) returned 1 [0156.456] GetCurrentProcess () returned 0xffffffff [0156.456] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea9c | out: TokenHandle=0x19ea9c*=0x368) returned 1 [0156.497] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x36c [0156.498] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x370 [0156.500] GetCurrentProcess () returned 0xffffffff [0156.500] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eaa4 | out: TokenHandle=0x19eaa4*=0x374) returned 1 [0156.505] GetCurrentProcess () returned 0xffffffff [0156.505] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eab8 | out: TokenHandle=0x19eab8*=0x378) returned 1 [0156.510] QueryPerformanceFrequency (in: lpFrequency=0x4b5a48 | out: lpFrequency=0x4b5a48*=100000000) returned 1 [0156.510] QueryPerformanceCounter (in: lpPerformanceCount=0x19eec0 | out: lpPerformanceCount=0x19eec0*=1693889717896) returned 1 [0156.516] GetCurrentProcess () returned 0xffffffff [0156.516] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea74 | out: TokenHandle=0x19ea74*=0x37c) returned 1 [0156.521] GetCurrentProcess () returned 0xffffffff [0156.521] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea88 | out: TokenHandle=0x19ea88*=0x380) returned 1 [0156.538] GetCurrentProcess () returned 0xffffffff [0156.538] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea88 | out: TokenHandle=0x19ea88*=0x384) returned 1 [0156.541] GetCurrentProcess () returned 0xffffffff [0156.541] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea9c | out: TokenHandle=0x19ea9c*=0x388) returned 1 [0156.551] GetCurrentProcess () returned 0xffffffff [0156.551] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eda8 | out: TokenHandle=0x19eda8*=0x38c) returned 1 [0156.584] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19def4 | out: phkResult=0x19def4*=0x390) returned 0x0 [0156.584] RegQueryValueExW (in: hKey=0x390, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19df14, lpData=0x0, lpcbData=0x19df10*=0x0 | out: lpType=0x19df14*=0x1, lpData=0x0, lpcbData=0x19df10*=0xe) returned 0x0 [0156.584] RegQueryValueExW (in: hKey=0x390, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19df14, lpData=0x22f55ac, lpcbData=0x19df10*=0xe | out: lpType=0x19df14*=0x1, lpData="Client", lpcbData=0x19df10*=0xe) returned 0x0 [0156.585] RegCloseKey (hKey=0x390) returned 0x0 [0157.335] CoTaskMemAlloc (cb=0xcc0) returned 0x6d0408 [0157.335] RasEnumConnectionsW (in: param_1=0x6d0408, param_2=0x19edb8, param_3=0x19edbc | out: param_1=0x6d0408, param_2=0x19edb8, param_3=0x19edbc) returned 0x0 [0157.565] CoTaskMemFree (pv=0x6d0408) [0158.023] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19eba0 | out: lpWSAData=0x19eba0) returned 0 [0158.038] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3e8 [0158.476] setsockopt (s=0x3e8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0158.477] closesocket (s=0x3e8) returned 0 [0158.477] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3e8 [0158.478] setsockopt (s=0x3e8, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0158.479] closesocket (s=0x3e8) returned 0 [0158.479] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3e8 [0158.480] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3ec [0158.480] ioctlsocket (in: s=0x3e8, cmd=-2147195266, argp=0x19edc0 | out: argp=0x19edc0) returned 0 [0158.481] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3f0 [0158.481] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f4 [0158.481] ioctlsocket (in: s=0x3f0, cmd=-2147195266, argp=0x19edc0 | out: argp=0x19edc0) returned 0 [0158.482] WSAIoctl (in: s=0x3e8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19eda8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19eda8, lpOverlapped=0x0) returned -1 [0158.483] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ead8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0158.491] WSAEventSelect (s=0x3e8, hEventObject=0x3ec, lNetworkEvents=512) returned 0 [0158.492] WSAIoctl (in: s=0x3f0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19eda8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19eda8, lpOverlapped=0x0) returned -1 [0158.492] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ead8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0158.492] WSAEventSelect (s=0x3f0, hEventObject=0x3f4, lNetworkEvents=512) returned 0 [0158.492] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3fc [0158.492] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x3fc, param_3=0x3) returned 0x0 [0158.508] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x19edd4 | out: phkResult=0x19edd4*=0x418) returned 0x0 [0158.508] RegOpenKeyExW (in: hKey=0x418, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed84 | out: phkResult=0x19ed84*=0x41c) returned 0x0 [0158.509] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x420 [0158.509] RegNotifyChangeKeyValue (hKey=0x41c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x420, fAsynchronous=1) returned 0x0 [0158.511] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed88 | out: phkResult=0x19ed88*=0x424) returned 0x0 [0158.511] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x428 [0158.511] RegNotifyChangeKeyValue (hKey=0x424, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x428, fAsynchronous=1) returned 0x0 [0158.512] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed88 | out: phkResult=0x19ed88*=0x42c) returned 0x0 [0158.512] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x430 [0158.512] RegNotifyChangeKeyValue (hKey=0x42c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x430, fAsynchronous=1) returned 0x0 [0158.513] GetCurrentProcess () returned 0xffffffff [0158.513] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ed7c | out: TokenHandle=0x19ed7c*=0x434) returned 1 [0158.518] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e688 | out: phkResult=0x19e688*=0x438) returned 0x0 [0158.518] RegQueryValueExW (in: hKey=0x438, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x19e6a4, lpData=0x0, lpcbData=0x19e6a0*=0x0 | out: lpType=0x19e6a4*=0x0, lpData=0x0, lpcbData=0x19e6a0*=0x0) returned 0x2 [0158.518] RegCloseKey (hKey=0x438) returned 0x0 [0158.948] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x6d7000 [0159.373] WinHttpSetTimeouts (hInternet=0x6d7000, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0159.374] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x19ed88 | out: pProxyConfig=0x19ed88) returned 1 [0160.001] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x19e600, nSize=0x80 | out: lpBuffer="") returned 0x0 [0160.001] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x19e600, nSize=0x80 | out: lpBuffer="") returned 0x0 [0160.009] EtwEventRegister (in: ProviderId=0x22f80fc, EnableCallback=0x4920636, CallbackContext=0x0, RegHandle=0x22f80d8 | out: RegHandle=0x22f80d8) returned 0x0 [0160.010] EtwEventSetInformation (RegHandle=0x6cd9b8, InformationClass=0x4d, EventInformation=0x2, InformationLength=0x22f8098) returned 0x0 [0160.015] GetCurrentProcess () returned 0xffffffff [0160.015] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea50 | out: TokenHandle=0x19ea50*=0x490) returned 1 [0160.019] GetCurrentProcess () returned 0xffffffff [0160.019] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea64 | out: TokenHandle=0x19ea64*=0x494) returned 1 [0160.035] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ecd4*=0x3fc, lpdwindex=0x19eaf4 | out: lpdwindex=0x19eaf4) returned 0x80010115 [0160.230] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ecb4*=0x3ec, lpdwindex=0x19ead4 | out: lpdwindex=0x19ead4) returned 0x80010115 [0160.231] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ecb4*=0x3f4, lpdwindex=0x19ead4 | out: lpdwindex=0x19ead4) returned 0x80010115 [0160.231] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ed08*=0x420, lpdwindex=0x19eb24 | out: lpdwindex=0x19eb24) returned 0x80010115 [0160.232] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ed08*=0x428, lpdwindex=0x19eb24 | out: lpdwindex=0x19eb24) returned 0x80010115 [0160.233] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ed08*=0x430, lpdwindex=0x19eb24 | out: lpdwindex=0x19eb24) returned 0x80010115 [0160.240] GetCurrentProcess () returned 0xffffffff [0160.240] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e9a4 | out: TokenHandle=0x19e9a4*=0x4b4) returned 1 [0160.241] GetCurrentProcess () returned 0xffffffff [0160.242] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e9b8 | out: TokenHandle=0x19e9b8*=0x4b8) returned 1 [0160.247] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19ebbc | out: lpTimeZoneInformation=0x19ebbc) returned 0x2 [0160.250] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x19ea10 | out: pTimeZoneInformation=0x19ea10) returned 0x2 [0160.252] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eaf4 | out: phkResult=0x19eaf4*=0x4bc) returned 0x0 [0160.252] RegQueryValueExW (in: hKey=0x4bc, lpValueName="TZI", lpReserved=0x0, lpType=0x19eb10, lpData=0x0, lpcbData=0x19eb0c*=0x0 | out: lpType=0x19eb10*=0x3, lpData=0x0, lpcbData=0x19eb0c*=0x2c) returned 0x0 [0160.253] RegQueryValueExW (in: hKey=0x4bc, lpValueName="TZI", lpReserved=0x0, lpType=0x19eb10, lpData=0x22fb198, lpcbData=0x19eb0c*=0x2c | out: lpType=0x19eb10*=0x3, lpData=0x22fb198*, lpcbData=0x19eb0c*=0x2c) returned 0x0 [0160.253] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e948 | out: phkResult=0x19e948*=0x0) returned 0x2 [0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19eae8, lpData=0x0, lpcbData=0x19eae4*=0x0 | out: lpType=0x19eae8*=0x1, lpData=0x0, lpcbData=0x19eae4*=0x20) returned 0x0 [0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19eae8, lpData=0x22fb5bc, lpcbData=0x19eae4*=0x20 | out: lpType=0x19eae8*=0x1, lpData="@tzres.dll,-320", lpcbData=0x19eae4*=0x20) returned 0x0 [0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19eae8, lpData=0x0, lpcbData=0x19eae4*=0x0 | out: lpType=0x19eae8*=0x1, lpData=0x0, lpcbData=0x19eae4*=0x20) returned 0x0 [0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19eae8, lpData=0x22fb614, lpcbData=0x19eae4*=0x20 | out: lpType=0x19eae8*=0x1, lpData="@tzres.dll,-322", lpcbData=0x19eae4*=0x20) returned 0x0 [0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19eae8, lpData=0x0, lpcbData=0x19eae4*=0x0 | out: lpType=0x19eae8*=0x1, lpData=0x0, lpcbData=0x19eae4*=0x20) returned 0x0 [0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19eae8, lpData=0x22fb66c, lpcbData=0x19eae4*=0x20 | out: lpType=0x19eae8*=0x1, lpData="@tzres.dll,-321", lpcbData=0x19eae4*=0x20) returned 0x0 [0160.256] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70 [0160.256] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6e3e70 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0160.258] CoTaskMemFree (pv=0x6e3e70) [0160.258] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70 [0160.258] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath=0x6e3e70, pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc | out: pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc) returned 1 [0160.286] CoTaskMemFree (pv=0x0) [0160.286] CoTaskMemFree (pv=0x6e3e70) [0160.287] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7ce0001 [0160.326] CoTaskMemAlloc (cb=0x3ec) returned 0x6e3e70 [0160.326] LoadStringW (in: hInstance=0x7ce0001, uID=0x140, lpBuffer=0x6e3e70, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0160.327] CoTaskMemFree (pv=0x6e3e70) [0160.327] FreeLibrary (hLibModule=0x7ce0001) returned 1 [0160.328] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70 [0160.328] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6e3e70 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0160.328] CoTaskMemFree (pv=0x6e3e70) [0160.328] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70 [0160.328] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath=0x6e3e70, pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc | out: pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc) returned 1 [0160.333] CoTaskMemFree (pv=0x0) [0160.333] CoTaskMemFree (pv=0x6e3e70) [0160.333] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7ce0001 [0160.338] CoTaskMemAlloc (cb=0x3ec) returned 0x6e3e70 [0160.338] LoadStringW (in: hInstance=0x7ce0001, uID=0x142, lpBuffer=0x6e3e70, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0160.338] CoTaskMemFree (pv=0x6e3e70) [0160.338] FreeLibrary (hLibModule=0x7ce0001) returned 1 [0160.338] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70 [0160.338] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6e3e70 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0160.339] CoTaskMemFree (pv=0x6e3e70) [0160.339] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70 [0160.339] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath=0x6e3e70, pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc | out: pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc) returned 1 [0160.342] CoTaskMemFree (pv=0x0) [0160.342] CoTaskMemFree (pv=0x6e3e70) [0160.342] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7ce0001 [0160.345] CoTaskMemAlloc (cb=0x3ec) returned 0x6e3e70 [0160.345] LoadStringW (in: hInstance=0x7ce0001, uID=0x141, lpBuffer=0x6e3e70, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0160.345] CoTaskMemFree (pv=0x6e3e70) [0160.345] FreeLibrary (hLibModule=0x7ce0001) returned 1 [0160.347] RegCloseKey (hKey=0x4bc) returned 0x0 [0160.349] SetEvent (hEvent=0x36c) returned 1 [0160.368] SetEvent (hEvent=0x36c) returned 1 [0160.373] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4d8 [0160.374] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4dc [0160.374] ioctlsocket (in: s=0x4d8, cmd=-2147195266, argp=0x19ed64 | out: argp=0x19ed64) returned 0 [0160.374] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e0 [0160.374] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4 [0160.374] ioctlsocket (in: s=0x4e0, cmd=-2147195266, argp=0x19ed64 | out: argp=0x19ed64) returned 0 [0160.374] WSAIoctl (in: s=0x4d8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19ed4c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19ed4c, lpOverlapped=0x0) returned -1 [0160.375] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ea7c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0160.375] WSAEventSelect (s=0x4d8, hEventObject=0x4dc, lNetworkEvents=512) returned 0 [0160.375] WSAIoctl (in: s=0x4e0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19ed4c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19ed4c, lpOverlapped=0x0) returned -1 [0160.375] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ea7c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0160.375] WSAEventSelect (s=0x4e0, hEventObject=0x4e4, lNetworkEvents=512) returned 0 [0160.388] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x19ed48*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x19ed48*=0xa78) returned 0x6f [0160.395] LocalAlloc (uFlags=0x0, uBytes=0xa78) returned 0x6e9e00 [0160.395] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x6e9e00, SizePointer=0x19ed48*=0xa78 | out: AdapterAddresses=0x6e9e00*(Alignment=0x500000178, Length=0x178, IfIndex=0x5, Next=0x6ea0a8, AdapterName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", FirstUnicastAddress=0x6ea01c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection", FriendlyName="Ethernet", PhysicalAddress=([0]=0xe8, [1]=0x7a, [2]=0xf3, [3]=0x1e, [4]=0xbb, [5]=0x8b, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x5, ZoneIndices=([0]=0x5, [1]=0x5, [2]=0x5, [3]=0x5, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008000000000, Dhcpv4Server.lpSockaddr=0x6e9f78*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x300053a, FirstDnsSuffix=0x0), SizePointer=0x19ed48*=0xa78) returned 0x0 [0160.411] LocalFree (hMem=0x6e9e00) returned 0x0 [0160.424] CoTaskMemAlloc (cb=0x20c) returned 0x6e9e00 [0160.424] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x6e9e00, nSize=0x104 | out: lpBuffer="") returned 0x0 [0160.425] CoTaskMemFree (pv=0x6e9e00) [0160.425] CoTaskMemAlloc (cb=0x20c) returned 0x6e9e00 [0160.425] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x6e9e00, nSize=0x104 | out: lpBuffer="") returned 0x0 [0160.425] CoTaskMemFree (pv=0x6e9e00) [0160.434] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e8 [0160.437] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4ec [0160.440] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19eb50*=0x4dc, lpdwindex=0x19e96c | out: lpdwindex=0x19e96c) returned 0x80010115 [0160.441] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19eb50*=0x4e4, lpdwindex=0x19e96c | out: lpdwindex=0x19e96c) returned 0x80010115 [0160.445] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ebd4 | out: phkResult=0x19ebd4*=0x4f0) returned 0x0 [0160.445] RegQueryValueExW (in: hKey=0x4f0, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x19ebf0, lpData=0x0, lpcbData=0x19ebec*=0x0 | out: lpType=0x19ebf0*=0x0, lpData=0x0, lpcbData=0x19ebec*=0x0) returned 0x2 [0160.445] RegCloseKey (hKey=0x4f0) returned 0x0 [0160.447] WSAConnect (in: s=0x4e8, name=0x23072f4*(sa_family=2, sin_port=0x2c50, sin_addr="192.30.89.67"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1 [0181.514] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0x19e9dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9 [0181.593] setsockopt (s=0x4e8, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0181.594] closesocket (s=0x4e8) returned 0 [0181.594] setsockopt (s=0x4ec, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0181.594] closesocket (s=0x4ec) returned 0 [0181.631] GetProcessWindowStation () returned 0xd0 [0181.635] GetUserObjectInformationA (in: hObj=0xd0, nIndex=1, pvInfo=0x230a084, nLength=0xc, lpnLengthNeeded=0x19eff0 | out: pvInfo=0x230a084, lpnLengthNeeded=0x19eff0) returned 1 [0181.672] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0181.673] AdjustWindowRectEx (in: lpRect=0x19eed0, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eed0) returned 1 [0181.674] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0181.675] AdjustWindowRectEx (in: lpRect=0x19eecc, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eecc) returned 1 [0181.678] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0181.678] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eec8) returned 1 [0181.679] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0181.679] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eec8) returned 1 [0181.679] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0181.679] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eec8) returned 1 [0181.680] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0181.680] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eec8) returned 1 [0181.682] GetDC (hWnd=0x0) returned 0x110106ca [0181.683] GdipCreateFromHDC (hdc=0x110106ca, graphics=0x19eda0) returned 0x0 [0181.684] GdipGetFontHeight (font=0x48aefc0, graphics=0x5b3f268, height=0x19ed98) returned 0x0 [0181.685] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0 [0181.685] ReleaseDC (hWnd=0x0, hDC=0x110106ca) returned 1 [0181.689] GetSystemMetrics (nIndex=5) returned 1 [0181.689] GetSystemMetrics (nIndex=6) returned 1 [0181.690] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0181.692] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19eec8) returned 1 [0181.692] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0181.693] AdjustWindowRectEx (in: lpRect=0x19ee9c, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19ee9c) returned 1 [0182.236] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", lpFilePart=0x0) returned 0x3a [0182.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1 [0182.236] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorlib.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6123a4b2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6123a4b2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x6126070c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x53a8a8)) returned 1 [0182.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1 [0182.238] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x81c [0182.357] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", dwHandle=0x0, dwLen=0x81c, lpData=0x23176d8 | out: lpData=0x23176d8) returned 1 [0182.391] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2317ae0, puLen=0x19eec4) returned 1 [0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317790, puLen=0x19ee44) returned 1 [0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23177e4, puLen=0x19ee44) returned 1 [0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317864, puLen=0x19ee44) returned 1 [0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23178c4, puLen=0x19ee44) returned 1 [0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317904, puLen=0x19ee44) returned 1 [0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231798c, puLen=0x19ee44) returned 1 [0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23179c8, puLen=0x19ee44) returned 1 [0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317a20, puLen=0x19ee44) returned 1 [0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317a50, puLen=0x19ee44) returned 1 [0182.394] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.394] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317a8c, puLen=0x19ee44) returned 1 [0182.394] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.394] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2317ae0, puLen=0x19ee38) returned 1 [0182.394] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0182.603] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x2317700, puLen=0x19ee48) returned 1 [0182.650] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19e990, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0182.651] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", lpFilePart=0x0) returned 0x33 [0182.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1 [0182.652] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10233118, ftCreationTime.dwHighDateTime=0x1d858a0, ftLastAccessTime.dwLowDateTime=0x10233118, ftLastAccessTime.dwHighDateTime=0x1d858a0, ftLastWriteTime.dwLowDateTime=0x611edffd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f938)) returned 1 [0182.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1 [0182.652] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x5ec [0182.652] GetFileVersionInfoW (in: lptstrFilename="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", dwHandle=0x0, dwLen=0x5ec, lpData=0x23199ec | out: lpData=0x23199ec) returned 1 [0182.652] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2319a88, puLen=0x19eec4) returned 1 [0182.652] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319b00, puLen=0x19ee44) returned 1 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319b2c, puLen=0x19ee44) returned 1 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319b54, puLen=0x19ee44) returned 1 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319b84, puLen=0x19ee44) returned 1 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319bc0, puLen=0x19ee44) returned 1 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319c38, puLen=0x19ee44) returned 1 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319c6c, puLen=0x19ee44) returned 1 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319c98, puLen=0x19ee44) returned 1 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319ade, puLen=0x19ee44) returned 1 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319c08, puLen=0x19ee44) returned 1 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2319a88, puLen=0x19ee38) returned 1 [0182.653] VerLanguageNameW (in: wLang=0x0, szLang=0x19ebcc, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x2319a14, puLen=0x19ee48) returned 1 [0182.654] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0182.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1 [0182.655] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5508362a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5508362a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5508362a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4944d8)) returned 1 [0182.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1 [0182.655] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x7fc [0182.661] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", dwHandle=0x0, dwLen=0x7fc, lpData=0x231b9b4 | out: lpData=0x231b9b4) returned 1 [0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x231bdac, puLen=0x19eec4) returned 1 [0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231ba6c, puLen=0x19ee44) returned 1 [0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bac0, puLen=0x19ee44) returned 1 [0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bb00, puLen=0x19ee44) returned 1 [0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bb60, puLen=0x19ee44) returned 1 [0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bbb8, puLen=0x19ee44) returned 1 [0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bc40, puLen=0x19ee44) returned 1 [0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bc94, puLen=0x19ee44) returned 1 [0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bcec, puLen=0x19ee44) returned 1 [0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bd1c, puLen=0x19ee44) returned 1 [0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bd58, puLen=0x19ee44) returned 1 [0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x231bdac, puLen=0x19ee38) returned 1 [0182.663] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x231b9dc, puLen=0x19ee48) returned 1 [0182.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x5b [0182.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1 [0182.744] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system\\v4.0_4.0.0.0__b77a5c561934e089\\system.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56075192, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x56075192, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5609b3ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x352688)) returned 1 [0182.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1 [0182.745] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x78c [0182.806] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", dwHandle=0x0, dwLen=0x78c, lpData=0x231dc5c | out: lpData=0x231dc5c) returned 1 [0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x231e01c, puLen=0x19eec4) returned 1 [0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231dd14, puLen=0x19ee44) returned 1 [0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231dd68, puLen=0x19ee44) returned 1 [0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231dda8, puLen=0x19ee44) returned 1 [0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231de08, puLen=0x19ee44) returned 1 [0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231de44, puLen=0x19ee44) returned 1 [0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231decc, puLen=0x19ee44) returned 1 [0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231df04, puLen=0x19ee44) returned 1 [0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231df5c, puLen=0x19ee44) returned 1 [0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231df8c, puLen=0x19ee44) returned 1 [0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231dfc8, puLen=0x19ee44) returned 1 [0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x231e01c, puLen=0x19ee38) returned 1 [0182.809] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x231dc84, puLen=0x19ee48) returned 1 [0182.810] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpFilePart=0x0) returned 0x6b [0182.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1 [0182.811] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.drawing.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cd8003, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x53cd8003, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x53cd8003, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x90eb0)) returned 1 [0182.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1 [0182.811] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x7cc [0182.832] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", dwHandle=0x0, dwLen=0x7cc, lpData=0x2320040 | out: lpData=0x2320040) returned 1 [0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2320420, puLen=0x19eec4) returned 1 [0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23200f8, puLen=0x19ee44) returned 1 [0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x232014c, puLen=0x19ee44) returned 1 [0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x232018c, puLen=0x19ee44) returned 1 [0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23201ec, puLen=0x19ee44) returned 1 [0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2320238, puLen=0x19ee44) returned 1 [0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23202c0, puLen=0x19ee44) returned 1 [0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2320308, puLen=0x19ee44) returned 1 [0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2320360, puLen=0x19ee44) returned 1 [0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2320390, puLen=0x19ee44) returned 1 [0182.834] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.834] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23203cc, puLen=0x19ee44) returned 1 [0182.834] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.834] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2320420, puLen=0x19ee38) returned 1 [0182.834] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0182.834] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x2320068, puLen=0x19ee48) returned 1 [0182.835] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x65 [0182.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1 [0182.836] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.core\\v4.0_4.0.0.0__b77a5c561934e089\\system.core.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x539dd101, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x539dd101, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x539dd101, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1406a0)) returned 1 [0182.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1 [0182.837] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x7ac [0182.870] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", dwHandle=0x0, dwLen=0x7ac, lpData=0x2322354 | out: lpData=0x2322354) returned 1 [0182.871] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2322724, puLen=0x19eec4) returned 1 [0182.871] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x232240c, puLen=0x19ee44) returned 1 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2322460, puLen=0x19ee44) returned 1 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23224a0, puLen=0x19ee44) returned 1 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2322500, puLen=0x19ee44) returned 1 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2322544, puLen=0x19ee44) returned 1 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23225cc, puLen=0x19ee44) returned 1 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x232260c, puLen=0x19ee44) returned 1 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2322664, puLen=0x19ee44) returned 1 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2322694, puLen=0x19ee44) returned 1 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23226d0, puLen=0x19ee44) returned 1 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2322724, puLen=0x19ee38) returned 1 [0182.872] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x232237c, puLen=0x19ee48) returned 1 [0182.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll", lpFilePart=0x0) returned 0x77 [0182.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1 [0182.874] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.configuration.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55010f1a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x55010f1a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x55010f1a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61ed0)) returned 1 [0182.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1 [0182.874] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x824 [0182.888] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll", dwHandle=0x0, dwLen=0x824, lpData=0x2324898 | out: lpData=0x2324898) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2324ca4, puLen=0x19eec4) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324950, puLen=0x19ee44) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23249a4, puLen=0x19ee44) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23249f8, puLen=0x19ee44) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324a58, puLen=0x19ee44) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324ab0, puLen=0x19ee44) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324b38, puLen=0x19ee44) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324b8c, puLen=0x19ee44) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324be4, puLen=0x19ee44) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324c14, puLen=0x19ee44) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324c50, puLen=0x19ee44) returned 1 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2324ca4, puLen=0x19ee38) returned 1 [0182.889] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x23248c0, puLen=0x19ee48) returned 1 [0182.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll", lpFilePart=0x0) returned 0x63 [0182.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1 [0182.891] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.xml\\v4.0_4.0.0.0__b77a5c561934e089\\system.xml.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56002a86, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x56002a86, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x56002a86, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x284ea0)) returned 1 [0182.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1 [0182.892] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x7ac [0182.939] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll", dwHandle=0x0, dwLen=0x7ac, lpData=0x2326c44 | out: lpData=0x2326c44) returned 1 [0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2327014, puLen=0x19eec4) returned 1 [0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326cfc, puLen=0x19ee44) returned 1 [0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326d50, puLen=0x19ee44) returned 1 [0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326d90, puLen=0x19ee44) returned 1 [0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326df0, puLen=0x19ee44) returned 1 [0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326e34, puLen=0x19ee44) returned 1 [0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326ebc, puLen=0x19ee44) returned 1 [0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326efc, puLen=0x19ee44) returned 1 [0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326f54, puLen=0x19ee44) returned 1 [0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326f84, puLen=0x19ee44) returned 1 [0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326fc0, puLen=0x19ee44) returned 1 [0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0 [0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2327014, puLen=0x19ee38) returned 1 [0182.941] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x2326c6c, puLen=0x19ee48) returned 1 [0182.942] GetCurrentActCtx (in: lphActCtx=0x19ee74 | out: lphActCtx=0x19ee74*=0x689cf4) returned 1 [0182.942] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0182.949] GetCurrentActCtx (in: lphActCtx=0x19edfc | out: lphActCtx=0x19edfc*=0x689cf4) returned 1 [0182.950] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0182.950] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0182.950] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="WindowsFormsParkingWindow", dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x601fe [0182.952] SetWindowLongW (hWnd=0x601fe, nIndex=-4, dwNewLong=2004528864) returned 76678590 [0182.952] GetWindowLongW (hWnd=0x601fe, nIndex=-4) returned 2004528864 [0182.953] SetWindowLongW (hWnd=0x601fe, nIndex=-4, dwNewLong=76678830) returned 2004528864 [0182.953] GetWindowLongW (hWnd=0x601fe, nIndex=-4) returned 76678830 [0182.953] GetWindowLongW (hWnd=0x601fe, nIndex=-16) returned 113311744 [0182.953] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x24, wParam=0x0, lParam=0x19e82c) returned 0x0 [0182.953] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x81, wParam=0x0, lParam=0x19e820) returned 0x1 [0182.954] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x83, wParam=0x0, lParam=0x19e80c) returned 0x0 [0182.955] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x1, wParam=0x0, lParam=0x19e820) returned 0x0 [0182.955] GetClientRect (in: hWnd=0x601fe, lpRect=0x19e530 | out: lpRect=0x19e530) returned 1 [0182.955] GetWindowRect (in: hWnd=0x601fe, lpRect=0x19e530 | out: lpRect=0x19e530) returned 1 [0182.955] SetWindowTextW (hWnd=0x601fe, lpString="WindowsFormsParkingWindow") returned 1 [0182.955] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0xc, wParam=0x0, lParam=0x232d0a0) returned 0x1 [0182.956] GetParent (hWnd=0x601fe) returned 0x0 [0182.957] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x232d330 | out: lpWndClass=0x232d330) returned 1 [0182.959] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0182.960] CoTaskMemAlloc (cb=0x58) returned 0x68c5e8 [0182.960] RegisterClassW (lpWndClass=0x19ed2c) returned 0xc20b [0182.960] CoTaskMemFree (pv=0x68c5e8) [0182.961] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0182.961] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=0, Y=0, nWidth=100, nHeight=23, hWndParent=0x601fe, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x801f0 [0182.963] SetWindowLongW (hWnd=0x801f0, nIndex=-4, dwNewLong=1862396288) returned 76678870 [0182.963] GetWindowLongW (hWnd=0x801f0, nIndex=-4) returned 1862396288 [0182.964] SetWindowLongW (hWnd=0x801f0, nIndex=-4, dwNewLong=76678326) returned 1862396288 [0182.964] GetWindowLongW (hWnd=0x801f0, nIndex=-4) returned 76678326 [0182.964] GetWindowLongW (hWnd=0x801f0, nIndex=-16) returned 1174405133 [0182.964] GetWindowLongW (hWnd=0x801f0, nIndex=-12) returned 0 [0182.964] SetWindowLongW (hWnd=0x801f0, nIndex=-12, dwNewLong=524784) returned 0 [0182.964] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x81, wParam=0x0, lParam=0x19e898) returned 0x1 [0182.967] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x83, wParam=0x0, lParam=0x19e884) returned 0x0 [0182.967] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x1, wParam=0x0, lParam=0x19e898) returned 0x0 [0182.970] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e588 | out: lpRect=0x19e588) returned 1 [0182.970] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e588 | out: lpRect=0x19e588) returned 1 [0182.970] GetParent (hWnd=0x801f0) returned 0x601fe [0182.970] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601fe, lpPoints=0x19e588, cPoints=0x2 | out: lpPoints=0x19e588) returned -1966088 [0182.971] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0182.971] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0182.971] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e5e0 | out: lpRect=0x19e5e0) returned 1 [0182.971] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e5e0 | out: lpRect=0x19e5e0) returned 1 [0182.972] GetParent (hWnd=0x801f0) returned 0x601fe [0182.972] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601fe, lpPoints=0x19e5e0, cPoints=0x2 | out: lpPoints=0x19e5e0) returned -1966088 [0182.972] SendMessageW (hWnd=0x801f0, Msg=0x2210, wParam=0x1f00001, lParam=0x801f0) returned 0x0 [0182.972] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x2210, wParam=0x1f00001, lParam=0x801f0) returned 0x0 [0182.972] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0182.973] GetParent (hWnd=0x801f0) returned 0x601fe [0182.973] GdipCreateFromHWND (hwnd=0x801f0, graphics=0x19eef8) returned 0x0 [0183.072] GdipMeasureString (graphics=0x5b3f268, string="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.", length=242, font=0x48aefc0, layoutRect=0x19eec0, stringFormat=0x0, boundingBox=0x19eeb0, codepointsFitted=0x19eeac, linesFilled=0x19eea8) returned 0x0 [0183.189] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0 [0183.189] GetForegroundWindow () returned 0x40268 [0183.305] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0183.306] GetCursorPos (in: lpPoint=0x232d77c | out: lpPoint=0x232d77c*(x=1155, y=87)) returned 1 [0183.350] MonitorFromPoint (pt=0x483, dwFlags=0x57) returned 0x10001 [0183.351] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19eca0 | out: lpmi=0x19eca0) returned 1 [0183.351] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x40105e1 [0183.351] GetDeviceCaps (hdc=0x40105e1, index=12) returned 32 [0183.352] GetDeviceCaps (hdc=0x40105e1, index=14) returned 1 [0183.352] DeleteDC (hdc=0x40105e1) returned 1 [0183.353] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ecf4 | out: lpmi=0x19ecf4) returned 1 [0183.353] AdjustWindowRectEx (in: lpRect=0x19ee8c, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19ee8c) returned 1 [0183.353] GetSystemMetrics (nIndex=59) returned 1456 [0183.353] GetSystemMetrics (nIndex=60) returned 916 [0183.353] GetSystemMetrics (nIndex=34) returned 136 [0183.353] GetSystemMetrics (nIndex=35) returned 39 [0183.355] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0183.355] GetCursorPos (in: lpPoint=0x232da18 | out: lpPoint=0x232da18*(x=1155, y=87)) returned 1 [0183.355] MonitorFromPoint (pt=0x481, dwFlags=0x59) returned 0x10001 [0183.355] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19eba4 | out: lpmi=0x19eba4) returned 1 [0183.356] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x50105e1 [0183.356] GetDeviceCaps (hdc=0x50105e1, index=12) returned 32 [0183.356] GetDeviceCaps (hdc=0x50105e1, index=14) returned 1 [0183.356] DeleteDC (hdc=0x50105e1) returned 1 [0183.356] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ebf8 | out: lpmi=0x19ebf8) returned 1 [0183.356] AdjustWindowRectEx (in: lpRect=0x19ed8c, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19ed8c) returned 1 [0183.397] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0183.398] AdjustWindowRectEx (in: lpRect=0x19ee58, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee58) returned 1 [0183.498] LoadIconW (hInstance=0x0, lpIconName=0x7f01) returned 0x1002d [0183.521] GetIconInfo (in: hIcon=0x1002d, piconinfo=0x232ddbc | out: piconinfo=0x232ddbc) returned 1 [0183.541] GetObjectW (in: h=0xae0509ae, c=24, pv=0x232ddd8 | out: pv=0x232ddd8) returned 24 [0183.542] GdipCreateBitmapFromHBITMAP (hbm=0xae0509ae, hpal=0x0, bitmap=0x19ede4) returned 0x0 [0183.544] GdipGetImageWidth (image=0x5b3f268, width=0x19ee00) returned 0x0 [0183.544] GdipGetImageHeight (image=0x5b3f268, height=0x19edfc) returned 0x0 [0183.544] GdipGetImagePixelFormat (image=0x5b3f268, format=0x19edf4) returned 0x0 [0183.545] GdipBitmapLockBits (bitmap=0x5b3f268, rect=0x19edb8, flags=0x1, format=0x22009, lockedBitmapData=0x232deac) returned 0x0 [0183.547] GdipCreateBitmapFromScan0 (width=32, height=32, stride=0, format=0x26200a, scan0=0x0, bitmap=0x19edf4) returned 0x0 [0183.547] GdipBitmapLockBits (bitmap=0x5b3f598, rect=0x19edb8, flags=0x2, format=0x26200a, lockedBitmapData=0x232dee4) returned 0x0 [0183.551] RtlMoveMemory (in: Destination=0x5b45628, Source=0x5b4aef0, Length=0x80 | out: Destination=0x5b45628) [0183.552] RtlMoveMemory (in: Destination=0x5b456a8, Source=0x5b4ae70, Length=0x80 | out: Destination=0x5b456a8) [0183.552] RtlMoveMemory (in: Destination=0x5b45728, Source=0x5b4adf0, Length=0x80 | out: Destination=0x5b45728) [0183.552] RtlMoveMemory (in: Destination=0x5b457a8, Source=0x5b4ad70, Length=0x80 | out: Destination=0x5b457a8) [0183.552] RtlMoveMemory (in: Destination=0x5b45828, Source=0x5b4acf0, Length=0x80 | out: Destination=0x5b45828) [0183.552] RtlMoveMemory (in: Destination=0x5b458a8, Source=0x5b4ac70, Length=0x80 | out: Destination=0x5b458a8) [0183.552] RtlMoveMemory (in: Destination=0x5b45928, Source=0x5b4abf0, Length=0x80 | out: Destination=0x5b45928) [0183.552] RtlMoveMemory (in: Destination=0x5b459a8, Source=0x5b4ab70, Length=0x80 | out: Destination=0x5b459a8) [0183.552] RtlMoveMemory (in: Destination=0x5b45a28, Source=0x5b4aaf0, Length=0x80 | out: Destination=0x5b45a28) [0183.552] RtlMoveMemory (in: Destination=0x5b45aa8, Source=0x5b4aa70, Length=0x80 | out: Destination=0x5b45aa8) [0183.552] RtlMoveMemory (in: Destination=0x5b45b28, Source=0x5b4a9f0, Length=0x80 | out: Destination=0x5b45b28) [0183.552] RtlMoveMemory (in: Destination=0x5b45ba8, Source=0x5b4a970, Length=0x80 | out: Destination=0x5b45ba8) [0183.552] RtlMoveMemory (in: Destination=0x5b45c28, Source=0x5b4a8f0, Length=0x80 | out: Destination=0x5b45c28) [0183.552] RtlMoveMemory (in: Destination=0x5b45ca8, Source=0x5b4a870, Length=0x80 | out: Destination=0x5b45ca8) [0183.552] RtlMoveMemory (in: Destination=0x5b45d28, Source=0x5b4a7f0, Length=0x80 | out: Destination=0x5b45d28) [0183.552] RtlMoveMemory (in: Destination=0x5b45da8, Source=0x5b4a770, Length=0x80 | out: Destination=0x5b45da8) [0183.552] RtlMoveMemory (in: Destination=0x5b45e28, Source=0x5b4a6f0, Length=0x80 | out: Destination=0x5b45e28) [0183.552] RtlMoveMemory (in: Destination=0x5b45ea8, Source=0x5b4a670, Length=0x80 | out: Destination=0x5b45ea8) [0183.552] RtlMoveMemory (in: Destination=0x5b45f28, Source=0x5b4a5f0, Length=0x80 | out: Destination=0x5b45f28) [0183.552] RtlMoveMemory (in: Destination=0x5b45fa8, Source=0x5b4a570, Length=0x80 | out: Destination=0x5b45fa8) [0183.553] RtlMoveMemory (in: Destination=0x5b46028, Source=0x5b4a4f0, Length=0x80 | out: Destination=0x5b46028) [0183.553] RtlMoveMemory (in: Destination=0x5b460a8, Source=0x5b4a470, Length=0x80 | out: Destination=0x5b460a8) [0183.553] RtlMoveMemory (in: Destination=0x5b46128, Source=0x5b4a3f0, Length=0x80 | out: Destination=0x5b46128) [0183.553] RtlMoveMemory (in: Destination=0x5b461a8, Source=0x5b4a370, Length=0x80 | out: Destination=0x5b461a8) [0183.553] RtlMoveMemory (in: Destination=0x5b46228, Source=0x5b4a2f0, Length=0x80 | out: Destination=0x5b46228) [0183.553] RtlMoveMemory (in: Destination=0x5b462a8, Source=0x5b4a270, Length=0x80 | out: Destination=0x5b462a8) [0183.553] RtlMoveMemory (in: Destination=0x5b46328, Source=0x5b4a1f0, Length=0x80 | out: Destination=0x5b46328) [0183.553] RtlMoveMemory (in: Destination=0x5b463a8, Source=0x5b4a170, Length=0x80 | out: Destination=0x5b463a8) [0183.553] RtlMoveMemory (in: Destination=0x5b46428, Source=0x5b4a0f0, Length=0x80 | out: Destination=0x5b46428) [0183.553] RtlMoveMemory (in: Destination=0x5b464a8, Source=0x5b4a070, Length=0x80 | out: Destination=0x5b464a8) [0183.553] RtlMoveMemory (in: Destination=0x5b46528, Source=0x5b49ff0, Length=0x80 | out: Destination=0x5b46528) [0183.553] RtlMoveMemory (in: Destination=0x5b465a8, Source=0x5b49f70, Length=0x80 | out: Destination=0x5b465a8) [0183.553] GdipBitmapUnlockBits (bitmap=0x5b3f268, lockedBitmapData=0x232deac) returned 0x0 [0183.554] GdipBitmapUnlockBits (bitmap=0x5b3f598, lockedBitmapData=0x232dee4) returned 0x0 [0183.554] GdipDisposeImage (image=0x5b3f268) returned 0x0 [0183.554] DeleteObject (ho=0xae0509ae) returned 1 [0183.554] DeleteObject (ho=0x60505e1) returned 1 [0183.554] GetCurrentThreadId () returned 0xbf8 [0183.554] GetCurrentThreadId () returned 0xbf8 [0183.558] SetWindowPos (hWnd=0x801f0, hWndInsertAfter=0x0, X=64, Y=8, cx=354, cy=68, uFlags=0x14) returned 1 [0183.559] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x46, wParam=0x0, lParam=0x19edd4) returned 0x0 [0183.559] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x83, wParam=0x1, lParam=0x19edac) returned 0x0 [0183.562] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x47, wParam=0x0, lParam=0x19edd4) returned 0x0 [0183.562] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x3, wParam=0x0, lParam=0x80040) returned 0x0 [0183.562] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e4f4 | out: lpRect=0x19e4f4) returned 1 [0183.562] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e4f4 | out: lpRect=0x19e4f4) returned 1 [0183.562] GetParent (hWnd=0x801f0) returned 0x601fe [0183.562] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601fe, lpPoints=0x19e4f4, cPoints=0x2 | out: lpPoints=0x19e4f4) returned -1966088 [0183.562] InvalidateRect (hWnd=0x801f0, lpRect=0x0, bErase=1) returned 1 [0183.563] GetWindowTextLengthW (hWnd=0x801f0) returned 0 [0183.563] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.563] GetSystemMetrics (nIndex=42) returned 0 [0183.563] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19e384, nMaxCount=1 | out: lpString="") returned 0 [0183.563] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0x1, lParam=0x19e384) returned 0x0 [0183.563] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x5, wParam=0x0, lParam=0x440162) returned 0x0 [0183.563] GetClientRect (in: hWnd=0x801f0, lpRect=0x19ead8 | out: lpRect=0x19ead8) returned 1 [0183.563] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19ead8 | out: lpRect=0x19ead8) returned 1 [0183.564] GetParent (hWnd=0x801f0) returned 0x601fe [0183.564] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601fe, lpPoints=0x19ead8, cPoints=0x2 | out: lpPoints=0x19ead8) returned -1966088 [0183.567] GetWindowTextLengthW (hWnd=0x801f0) returned 0 [0183.567] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.567] GetSystemMetrics (nIndex=42) returned 0 [0183.567] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19ee30, nMaxCount=1 | out: lpString="") returned 0 [0183.567] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0x1, lParam=0x19ee30) returned 0x0 [0183.567] GetWindowTextLengthW (hWnd=0x801f0) returned 0 [0183.567] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0183.567] GetSystemMetrics (nIndex=42) returned 0 [0183.567] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19ee2c, nMaxCount=1 | out: lpString="") returned 0 [0183.567] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0x1, lParam=0x19ee2c) returned 0x0 [0183.568] SetWindowTextW (hWnd=0x801f0, lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.") returned 1 [0183.568] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xc, wParam=0x0, lParam=0x230c918) returned 0x1 [0183.568] InvalidateRect (hWnd=0x801f0, lpRect=0x0, bErase=1) returned 1 [0183.568] GetCurrentThreadId () returned 0xbf8 [0183.569] GetWindowThreadProcessId (in: hWnd=0x801f0, lpdwProcessId=0x19eeb8 | out: lpdwProcessId=0x19eeb8) returned 0xbf8 [0183.587] GdipCreateBitmapFromStream (stream=0x8650030, bitmap=0x19eef4) returned 0x0 [0183.949] GdipImageForceValidation (image=0x5b3f268) returned 0x0 [0183.954] GdipGetImageRawFormat (image=0x5b3f268, format=0x19ee74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0183.957] GdipGetImageHeight (image=0x5b3f268, height=0x19eed8) returned 0x0 [0183.957] GdipGetImageWidth (image=0x5b3f268, width=0x19eed8) returned 0x0 [0183.957] GdipGetImageWidth (image=0x5b3f268, width=0x19eec4) returned 0x0 [0183.957] GdipGetImageHeight (image=0x5b3f268, height=0x19eec4) returned 0x0 [0183.957] GdipGetImageWidth (image=0x5b3f268, width=0x19eeb4) returned 0x0 [0183.957] GdipGetImageHeight (image=0x5b3f268, height=0x19eeb4) returned 0x0 [0183.957] GdipBitmapGetPixel (bitmap=0x5b3f268, x=0, y=15, color=0x19eec4) returned 0x0 [0183.959] GdipGetImageRawFormat (image=0x5b3f268, format=0x19edf4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0183.959] GdipGetImageWidth (image=0x5b3f268, width=0x19edf4) returned 0x0 [0183.959] GdipGetImageHeight (image=0x5b3f268, height=0x19edf4) returned 0x0 [0183.959] GdipCreateBitmapFromScan0 (width=16, height=16, stride=0, format=0x26200a, scan0=0x0, bitmap=0x19edf8) returned 0x0 [0183.959] GdipGetImagePixelFormat (image=0x5b47f18, format=0x19edf4) returned 0x0 [0183.959] GdipGetImageGraphicsContext (image=0x5b47f18, graphics=0x19ee00) returned 0x0 [0183.960] GdipGraphicsClear (graphics=0x5b498b8, color=0xffffff) returned 0x0 [0183.961] GdipCreateImageAttributes (imageattr=0x19ee04) returned 0x0 [0183.961] GdipSetImageAttributesColorKeys (imageattr=0x5b46b80, type=0x0, enableFlag=1, colorLow=0xffc0c0c0, colorHigh=0xffc0c0c0) returned 0x0 [0183.961] GdipDrawImageRectRectI (graphics=0x5b498b8, image=0x5b3f268, dstx=0, dsty=0, dstwidth=16, dstheight=16, srcx=0, srcy=0, srcwidth=16, srcheight=16, srcUnit=0x2, imageAttributes=0x5b46b80, callback=0x0, callbackData=0x0) returned 0x0 [0183.962] GdipDisposeImageAttributes (imageattr=0x5b46b80) returned 0x0 [0183.962] GdipDeleteGraphics (graphics=0x5b498b8) returned 0x0 [0183.962] GdipDisposeImage (image=0x5b3f268) returned 0x0 [0183.963] GdipCreateBitmapFromStream (stream=0x8650010, bitmap=0x19eef4) returned 0x0 [0183.964] GdipImageForceValidation (image=0x5b3f268) returned 0x0 [0183.965] GdipGetImageRawFormat (image=0x5b3f268, format=0x19ee74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0183.965] GdipGetImageHeight (image=0x5b3f268, height=0x19eed8) returned 0x0 [0183.965] GdipGetImageWidth (image=0x5b3f268, width=0x19eed8) returned 0x0 [0183.965] GdipGetImageWidth (image=0x5b3f268, width=0x19eec4) returned 0x0 [0183.966] GdipGetImageHeight (image=0x5b3f268, height=0x19eec4) returned 0x0 [0183.966] GdipGetImageWidth (image=0x5b3f268, width=0x19eeb4) returned 0x0 [0183.966] GdipGetImageHeight (image=0x5b3f268, height=0x19eeb4) returned 0x0 [0183.966] GdipBitmapGetPixel (bitmap=0x5b3f268, x=0, y=15, color=0x19eec4) returned 0x0 [0183.966] GdipGetImageRawFormat (image=0x5b3f268, format=0x19edf4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0183.966] GdipGetImageWidth (image=0x5b3f268, width=0x19edf4) returned 0x0 [0183.966] GdipGetImageHeight (image=0x5b3f268, height=0x19edf4) returned 0x0 [0183.966] GdipCreateBitmapFromScan0 (width=16, height=16, stride=0, format=0x26200a, scan0=0x0, bitmap=0x19edf8) returned 0x0 [0183.966] GdipGetImagePixelFormat (image=0x5b498b8, format=0x19edf4) returned 0x0 [0183.966] GdipGetImageGraphicsContext (image=0x5b498b8, graphics=0x19ee00) returned 0x0 [0183.966] GdipGraphicsClear (graphics=0x5b49f70, color=0xffffff) returned 0x0 [0183.966] GdipCreateImageAttributes (imageattr=0x19ee04) returned 0x0 [0183.966] GdipSetImageAttributesColorKeys (imageattr=0x5b48478, type=0x0, enableFlag=1, colorLow=0xffc0c0c0, colorHigh=0xffc0c0c0) returned 0x0 [0183.966] GdipDrawImageRectRectI (graphics=0x5b49f70, image=0x5b3f268, dstx=0, dsty=0, dstwidth=16, dstheight=16, srcx=0, srcy=0, srcwidth=16, srcheight=16, srcUnit=0x2, imageAttributes=0x5b48478, callback=0x0, callbackData=0x0) returned 0x0 [0183.967] GdipDisposeImageAttributes (imageattr=0x5b48478) returned 0x0 [0183.967] GdipDeleteGraphics (graphics=0x5b49f70) returned 0x0 [0183.967] GdipDisposeImage (image=0x5b3f268) returned 0x0 [0183.967] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0183.967] AdjustWindowRectEx (in: lpRect=0x19ee70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee70) returned 1 [0183.969] GetCurrentThreadId () returned 0xbf8 [0183.969] GetCurrentThreadId () returned 0xbf8 [0183.970] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0183.970] AdjustWindowRectEx (in: lpRect=0x19ee70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee70) returned 1 [0183.970] GetCurrentThreadId () returned 0xbf8 [0183.970] GetCurrentThreadId () returned 0xbf8 [0183.970] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0183.970] AdjustWindowRectEx (in: lpRect=0x19ee70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee70) returned 1 [0183.970] GetCurrentThreadId () returned 0xbf8 [0183.970] GetCurrentThreadId () returned 0xbf8 [0183.975] GetSystemMetrics (nIndex=5) returned 1 [0183.975] GetSystemMetrics (nIndex=6) returned 1 [0183.975] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0183.975] AdjustWindowRectEx (in: lpRect=0x19edc4, dwStyle=0x56210044, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19edc4) returned 1 [0183.976] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0183.976] AdjustWindowRectEx (in: lpRect=0x19edc4, dwStyle=0x56210044, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19edc4) returned 1 [0183.979] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0183.979] AdjustWindowRectEx (in: lpRect=0x19ee44, dwStyle=0x563008c4, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19ee44) returned 1 [0183.979] GetCurrentThreadId () returned 0xbf8 [0183.979] GetCurrentThreadId () returned 0xbf8 [0183.987] GetProcessWindowStation () returned 0xd0 [0183.987] GetCapture () returned 0x0 [0183.987] GetActiveWindow () returned 0x0 [0183.988] GetCurrentActCtx (in: lphActCtx=0x19ef00 | out: lphActCtx=0x19ef00*=0x689cf4) returned 1 [0183.988] GetProcessWindowStation () returned 0xd0 [0183.991] OleInitialize (pvReserved=0x0) returned 0x0 [0183.992] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x19ee80 | out: lplpMessageFilter=0x19ee80*=0x0) returned 0x0 [0183.998] GetCurrentThreadId () returned 0xbf8 [0183.998] EnumThreadWindows (dwThreadId=0xbf8, lpfn=0x492058e, lParam=0x0) returned 1 [0183.999] IsWindowVisible (hWnd=0x7032c) returned 0 [0183.999] IsWindowVisible (hWnd=0x802a2) returned 1 [0183.999] IsWindowEnabled (hWnd=0x802a2) returned 1 [0183.999] IsWindowVisible (hWnd=0x40200) returned 0 [0183.999] IsWindowVisible (hWnd=0xc01e4) returned 0 [0183.999] GetActiveWindow () returned 0x0 [0183.999] GetFocus () returned 0x0 [0183.999] IsWindow (hWnd=0x802a2) returned 1 [0184.000] EnableWindow (hWnd=0x802a2, bEnable=0) returned 0 [0184.000] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0184.001] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0 [0184.001] GetCurrentActCtx (in: lphActCtx=0x19edf0 | out: lphActCtx=0x19edf0*=0x689cf4) returned 1 [0184.002] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0184.002] AdjustWindowRectEx (in: lpRect=0x19ed54, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19ed54) returned 1 [0184.002] GetCursorPos (in: lpPoint=0x232f980 | out: lpPoint=0x232f980*(x=1155, y=87)) returned 1 [0184.002] MonitorFromPoint (pt=0x483, dwFlags=0x57) returned 0x10001 [0184.002] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ec30 | out: lpmi=0x19ec30) returned 1 [0184.002] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x70105e1 [0184.002] GetDeviceCaps (hdc=0x70105e1, index=12) returned 32 [0184.002] GetDeviceCaps (hdc=0x70105e1, index=14) returned 1 [0184.002] DeleteDC (hdc=0x70105e1) returned 1 [0184.003] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ec84 | out: lpmi=0x19ec84) returned 1 [0184.003] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0184.003] CreateWindowExW (dwExStyle=0x50001, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="Microsoft .NET Framework", dwStyle=0x2c80000, X=493, Y=348, nWidth=454, nHeight=164, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0xb004c [0184.004] SetWindowLongW (hWnd=0xb004c, nIndex=-4, dwNewLong=2004528864) returned 76678590 [0184.004] GetWindowLongW (hWnd=0xb004c, nIndex=-4) returned 2004528864 [0184.004] SetWindowLongW (hWnd=0xb004c, nIndex=-4, dwNewLong=76692046) returned 2004528864 [0184.004] GetWindowLongW (hWnd=0xb004c, nIndex=-4) returned 76692046 [0184.004] GetWindowLongW (hWnd=0xb004c, nIndex=-16) returned 113770496 [0184.005] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x81, wParam=0x0, lParam=0x19e810) returned 0x1 [0184.005] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x83, wParam=0x0, lParam=0x19e7fc) returned 0x0 [0184.006] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x1, wParam=0x0, lParam=0x19e810) returned 0x0 [0184.006] GetClientRect (in: hWnd=0xb004c, lpRect=0x19e50c | out: lpRect=0x19e50c) returned 1 [0184.006] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19e50c | out: lpRect=0x19e50c) returned 1 [0184.007] SetWindowTextW (hWnd=0xb004c, lpString="Microsoft .NET Framework") returned 1 [0184.007] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xc, wParam=0x0, lParam=0x232d650) returned 0x1 [0184.007] GetStartupInfoW (in: lpStartupInfo=0x232fcbc | out: lpStartupInfo=0x232fcbc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0184.008] GetParent (hWnd=0xb004c) returned 0x0 [0184.008] SetWindowLongW (hWnd=0xb004c, nIndex=-8, dwNewLong=0) returned 0 [0184.009] SendMessageW (hWnd=0xb004c, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0184.009] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0 [0184.010] SendMessageW (hWnd=0xb004c, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0184.010] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0184.010] GetSystemMenu (hWnd=0xb004c, bRevert=0) returned 0xa80307 [0184.010] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19ee00 | out: lpwndpl=0x19ee00) returned 1 [0184.011] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf020, uEnable=0x1) returned 0 [0184.011] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf030, uEnable=0x1) returned 0 [0184.011] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0184.011] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0184.011] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf000, uEnable=0x1) returned 0 [0184.011] GetClientRect (in: hWnd=0xb004c, lpRect=0x19ee44 | out: lpRect=0x19ee44) returned 1 [0184.011] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eda4 | out: lpRect=0x19eda4) returned 1 [0184.011] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eda4 | out: lpRect=0x19eda4) returned 1 [0184.011] SetWindowPos (hWnd=0xb004c, hWndInsertAfter=0xffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0184.011] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19edbc) returned 0x0 [0184.013] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19edbc) returned 0x0 [0184.013] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0184.013] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0184.013] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0184.013] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0184.013] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0184.015] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0184.015] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0184.015] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0184.026] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0184.031] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0184.032] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0184.032] GetParent (hWnd=0xb004c) returned 0x0 [0184.032] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0184.032] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0184.032] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19eb2c | out: lpwndpl=0x19eb2c) returned 1 [0184.032] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x47, wParam=0x0, lParam=0x19edbc) returned 0x0 [0184.032] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eadc | out: lpRect=0x19eadc) returned 1 [0184.032] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eadc | out: lpRect=0x19eadc) returned 1 [0184.033] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0184.034] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0184.034] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0184.035] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0184.035] GetWindowLongW (hWnd=0xb004c, nIndex=-16) returned 113770496 [0184.035] GetWindowTextLengthW (hWnd=0xb004c) returned 24 [0184.035] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0184.035] GetSystemMetrics (nIndex=42) returned 0 [0184.035] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19ed20, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0184.035] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19ed20) returned 0x18 [0184.035] GetWindowTextLengthW (hWnd=0xb004c) returned 24 [0184.035] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0184.035] GetSystemMetrics (nIndex=42) returned 0 [0184.035] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19ed20, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0184.036] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19ed20) returned 0x18 [0184.036] GetCursorPos (in: lpPoint=0x233001c | out: lpPoint=0x233001c*(x=1155, y=87)) returned 1 [0184.036] MonitorFromPoint (pt=0x483, dwFlags=0x59) returned 0x10001 [0184.036] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ec70 | out: lpmi=0x19ec70) returned 1 [0184.036] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x110105e1 [0184.036] GetDeviceCaps (hdc=0x110105e1, index=12) returned 32 [0184.036] GetDeviceCaps (hdc=0x110105e1, index=14) returned 1 [0184.036] DeleteDC (hdc=0x110105e1) returned 1 [0184.036] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ecc4 | out: lpmi=0x19ecc4) returned 1 [0184.037] GetWindowLongW (hWnd=0xb004c, nIndex=-16) returned 113770496 [0184.037] GetWindowLongW (hWnd=0xb004c, nIndex=-20) returned 327945 [0184.037] SetWindowLongW (hWnd=0xb004c, nIndex=-16, dwNewLong=46661632) returned 113770496 [0184.037] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7c, wParam=0xfffffff0, lParam=0x19ed9c) returned 0x0 [0184.037] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7d, wParam=0xfffffff0, lParam=0x19ed9c) returned 0x0 [0184.038] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0184.038] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0184.038] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0184.039] SetWindowLongW (hWnd=0xb004c, nIndex=-20, dwNewLong=327681) returned 327945 [0184.039] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7c, wParam=0xffffffec, lParam=0x19ed9c) returned 0x0 [0184.039] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7d, wParam=0xffffffec, lParam=0x19ed9c) returned 0x0 [0184.040] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0184.040] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0184.040] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0184.041] SetWindowPos (hWnd=0xb004c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0184.041] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19edbc) returned 0x0 [0184.041] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x83, wParam=0x1, lParam=0x19ed94) returned 0x0 [0184.042] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19eb2c | out: lpwndpl=0x19eb2c) returned 1 [0184.042] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x47, wParam=0x0, lParam=0x19edbc) returned 0x0 [0184.042] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eadc | out: lpRect=0x19eadc) returned 1 [0184.042] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eadc | out: lpRect=0x19eadc) returned 1 [0184.043] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0184.043] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0184.043] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0184.044] RedrawWindow (hWnd=0xb004c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0184.044] GetSystemMenu (hWnd=0xb004c, bRevert=0) returned 0xa80307 [0184.044] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19edf0 | out: lpwndpl=0x19edf0) returned 1 [0184.044] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf020, uEnable=0x1) returned 1 [0184.044] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf030, uEnable=0x1) returned 1 [0184.044] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0184.045] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0184.045] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf000, uEnable=0x1) returned 1 [0184.045] GetWindowLongW (hWnd=0xb004c, nIndex=-8) returned 0 [0184.045] IsWindowEnabled (hWnd=0xb004c) returned 1 [0184.045] ShowWindow (hWnd=0xb004c, nCmdShow=5) returned 0 [0184.045] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0184.045] GetCurrentActCtx (in: lphActCtx=0x19e9b0 | out: lphActCtx=0x19e9b0*=0x689cf4) returned 1 [0184.045] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0184.046] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0184.046] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x56000000, X=0, Y=0, nWidth=64, nHeight=64, hWndParent=0xb004c, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x3031c [0184.046] SetWindowLongW (hWnd=0x3031c, nIndex=-4, dwNewLong=2004528864) returned 76678590 [0184.047] GetWindowLongW (hWnd=0x3031c, nIndex=-4) returned 2004528864 [0184.048] SetWindowLongW (hWnd=0x3031c, nIndex=-4, dwNewLong=76692086) returned 2004528864 [0184.048] GetWindowLongW (hWnd=0x3031c, nIndex=-4) returned 76692086 [0184.048] GetWindowLongW (hWnd=0x3031c, nIndex=-16) returned 1174405120 [0184.048] GetWindowLongW (hWnd=0x3031c, nIndex=-12) returned 0 [0184.048] SetWindowLongW (hWnd=0x3031c, nIndex=-12, dwNewLong=197404) returned 0 [0184.048] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x81, wParam=0x0, lParam=0x19e3d0) returned 0x1 [0184.048] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x83, wParam=0x0, lParam=0x19e3bc) returned 0x0 [0184.049] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x1, wParam=0x0, lParam=0x19e3d0) returned 0x0 [0184.049] GetWindow (hWnd=0x3031c, uCmd=0x3) returned 0x0 [0184.049] GetClientRect (in: hWnd=0x3031c, lpRect=0x19e0fc | out: lpRect=0x19e0fc) returned 1 [0184.049] GetWindowRect (in: hWnd=0x3031c, lpRect=0x19e0fc | out: lpRect=0x19e0fc) returned 1 [0184.049] GetParent (hWnd=0x3031c) returned 0xb004c [0184.049] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0fc, cPoints=0x2 | out: lpPoints=0x19e0fc) returned -24773109 [0184.050] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x5, wParam=0x0, lParam=0x400040) returned 0x0 [0184.050] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0184.050] GetClientRect (in: hWnd=0x3031c, lpRect=0x19e154 | out: lpRect=0x19e154) returned 1 [0184.050] GetWindowRect (in: hWnd=0x3031c, lpRect=0x19e154 | out: lpRect=0x19e154) returned 1 [0184.050] GetParent (hWnd=0x3031c) returned 0xb004c [0184.050] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e154, cPoints=0x2 | out: lpPoints=0x19e154) returned -24773109 [0184.050] SendMessageW (hWnd=0x3031c, Msg=0x2210, wParam=0x31c0001, lParam=0x3031c) returned 0x0 [0184.050] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x2210, wParam=0x31c0001, lParam=0x3031c) returned 0x0 [0184.050] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0184.051] GetParent (hWnd=0x3031c) returned 0xb004c [0184.051] GetParent (hWnd=0x801f0) returned 0x601fe [0184.051] SetParent (hWndChild=0x801f0, hWndNewParent=0xb004c) returned 0x601fe [0184.051] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0184.052] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x46, wParam=0x0, lParam=0x19e9ac) returned 0x0 [0184.053] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0184.053] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x47, wParam=0x0, lParam=0x19e9ac) returned 0x0 [0184.053] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x3, wParam=0x0, lParam=0x80040) returned 0x0 [0184.053] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e0cc | out: lpRect=0x19e0cc) returned 1 [0184.053] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e0cc | out: lpRect=0x19e0cc) returned 1 [0184.053] GetParent (hWnd=0x801f0) returned 0xb004c [0184.053] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0cc, cPoints=0x2 | out: lpPoints=0x19e0cc) returned -24773109 [0184.053] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e6b0 | out: lpRect=0x19e6b0) returned 1 [0184.053] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e6b0 | out: lpRect=0x19e6b0) returned 1 [0184.053] GetParent (hWnd=0x801f0) returned 0xb004c [0184.053] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e6b0, cPoints=0x2 | out: lpPoints=0x19e6b0) returned -24773109 [0184.053] GetParent (hWnd=0x801f0) returned 0xb004c [0184.054] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0184.054] GetWindow (hWnd=0x801f0, uCmd=0x3) returned 0x0 [0184.054] SetWindowPos (hWnd=0x801f0, hWndInsertAfter=0x3031c, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1 [0184.054] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x46, wParam=0x0, lParam=0x19e954) returned 0x0 [0184.055] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0 [0184.056] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x47, wParam=0x0, lParam=0x19e954) returned 0x0 [0184.056] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e658 | out: lpRect=0x19e658) returned 1 [0184.056] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e658 | out: lpRect=0x19e658) returned 1 [0184.056] GetParent (hWnd=0x801f0) returned 0xb004c [0184.056] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e658, cPoints=0x2 | out: lpPoints=0x19e658) returned -24773109 [0184.056] GetParent (hWnd=0x801f0) returned 0xb004c [0184.056] GetWindow (hWnd=0x801f0, uCmd=0x3) returned 0x3031c [0184.056] GetWindowThreadProcessId (in: hWnd=0x801f0, lpdwProcessId=0x19ea24 | out: lpdwProcessId=0x19ea24) returned 0xbf8 [0184.056] GetCurrentActCtx (in: lphActCtx=0x19e9b0 | out: lphActCtx=0x19e9b0*=0x689cf4) returned 1 [0184.056] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0184.057] GetClassInfoW (in: hInstance=0x0, lpClassName="BUTTON", lpWndClass=0x233042c | out: lpWndClass=0x233042c) returned 1 [0184.057] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0184.058] CoTaskMemAlloc (cb=0x58) returned 0x7057d0 [0184.058] RegisterClassW (lpWndClass=0x19e868) returned 0xc20c [0184.058] CoTaskMemFree (pv=0x7057d0) [0184.058] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0184.058] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.141b42a_r10_ad1", lpWindowName="&Details", dwStyle=0x5601000b, X=8, Y=94, nWidth=100, nHeight=23, hWndParent=0xb004c, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x701de [0184.058] SetWindowLongW (hWnd=0x701de, nIndex=-4, dwNewLong=1862787184) returned 76692126 [0184.059] GetWindowLongW (hWnd=0x701de, nIndex=-4) returned 1862787184 [0184.059] SetWindowLongW (hWnd=0x701de, nIndex=-4, dwNewLong=76692166) returned 1862787184 [0184.059] GetWindowLongW (hWnd=0x701de, nIndex=-4) returned 76692166 [0184.059] GetWindowLongW (hWnd=0x701de, nIndex=-16) returned 1174470667 [0184.059] GetWindowLongW (hWnd=0x701de, nIndex=-12) returned 0 [0184.059] SetWindowLongW (hWnd=0x701de, nIndex=-12, dwNewLong=459230) returned 0 [0184.059] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x81, wParam=0x0, lParam=0x19e3d0) returned 0x1 [0184.061] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x83, wParam=0x0, lParam=0x19e3bc) returned 0x0 [0184.061] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x1, wParam=0x0, lParam=0x19e3d0) returned 0x0 [0184.063] SendMessageW (hWnd=0x701de, Msg=0x2055, wParam=0x701de, lParam=0x3) returned 0x2 [0184.063] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0 [0184.063] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0184.063] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0184.063] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0184.063] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0184.063] RedrawWindow (hWnd=0x3031c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0184.063] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0184.064] RedrawWindow (hWnd=0x801f0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0184.064] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0 [0184.064] RedrawWindow (hWnd=0x701de, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0184.064] RedrawWindow (hWnd=0xb004c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0184.064] GetWindow (hWnd=0x701de, uCmd=0x3) returned 0x801f0 [0184.064] GetClientRect (in: hWnd=0x701de, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1 [0184.064] GetWindowRect (in: hWnd=0x701de, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1 [0184.064] GetParent (hWnd=0x701de) returned 0xb004c [0184.064] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0b4, cPoints=0x2 | out: lpPoints=0x19e0b4) returned -24773109 [0184.065] SetWindowTextW (hWnd=0x701de, lpString="&Details") returned 1 [0184.065] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0xc, wParam=0x0, lParam=0x232e2f0) returned 0x1 [0184.066] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0184.066] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x3, wParam=0x0, lParam=0x5e0008) returned 0x0 [0184.066] GetClientRect (in: hWnd=0x701de, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1 [0184.066] GetWindowRect (in: hWnd=0x701de, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1 [0184.066] GetParent (hWnd=0x701de) returned 0xb004c [0184.066] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e10c, cPoints=0x2 | out: lpPoints=0x19e10c) returned -24773109 [0184.066] SendMessageW (hWnd=0x701de, Msg=0x2210, wParam=0x1de0001, lParam=0x701de) returned 0x0 [0184.066] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x2210, wParam=0x1de0001, lParam=0x701de) returned 0x0 [0184.066] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0184.067] GetParent (hWnd=0x701de) returned 0xb004c [0184.067] GetCurrentActCtx (in: lphActCtx=0x19e9b0 | out: lphActCtx=0x19e9b0*=0x689cf4) returned 1 [0184.067] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0184.068] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0184.068] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.141b42a_r10_ad1", lpWindowName="&Continue", dwStyle=0x5601000b, X=225, Y=94, nWidth=100, nHeight=23, hWndParent=0xb004c, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x5028a [0184.069] SetWindowLongW (hWnd=0x5028a, nIndex=-4, dwNewLong=1862787184) returned 76692126 [0184.069] GetWindowLongW (hWnd=0x5028a, nIndex=-4) returned 1862787184 [0184.069] SetWindowLongW (hWnd=0x5028a, nIndex=-4, dwNewLong=76692966) returned 1862787184 [0184.069] GetWindowLongW (hWnd=0x5028a, nIndex=-4) returned 76692966 [0184.069] GetWindowLongW (hWnd=0x5028a, nIndex=-16) returned 1174470667 [0184.070] GetWindowLongW (hWnd=0x5028a, nIndex=-12) returned 0 [0184.070] SetWindowLongW (hWnd=0x5028a, nIndex=-12, dwNewLong=328330) returned 0 [0184.070] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x81, wParam=0x0, lParam=0x19e3d0) returned 0x1 [0184.071] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x83, wParam=0x0, lParam=0x19e3bc) returned 0x0 [0184.071] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x1, wParam=0x0, lParam=0x19e3d0) returned 0x0 [0184.072] SendMessageW (hWnd=0x5028a, Msg=0x2055, wParam=0x5028a, lParam=0x3) returned 0x2 [0184.072] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0184.072] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0184.072] GetWindow (hWnd=0x5028a, uCmd=0x3) returned 0x701de [0184.072] GetClientRect (in: hWnd=0x5028a, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1 [0184.072] GetWindowRect (in: hWnd=0x5028a, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1 [0184.072] GetParent (hWnd=0x5028a) returned 0xb004c [0184.072] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0b4, cPoints=0x2 | out: lpPoints=0x19e0b4) returned -24773109 [0184.073] SetWindowTextW (hWnd=0x5028a, lpString="&Continue") returned 1 [0184.073] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0xc, wParam=0x0, lParam=0x232e204) returned 0x1 [0184.073] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0184.074] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x3, wParam=0x0, lParam=0x5e00e1) returned 0x0 [0184.074] GetClientRect (in: hWnd=0x5028a, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1 [0184.074] GetWindowRect (in: hWnd=0x5028a, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1 [0184.074] GetParent (hWnd=0x5028a) returned 0xb004c [0184.074] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e10c, cPoints=0x2 | out: lpPoints=0x19e10c) returned -24773109 [0184.074] SendMessageW (hWnd=0x5028a, Msg=0x2210, wParam=0x28a0001, lParam=0x5028a) returned 0x0 [0184.074] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x2210, wParam=0x28a0001, lParam=0x5028a) returned 0x0 [0184.074] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0184.074] GetParent (hWnd=0x5028a) returned 0xb004c [0184.074] GetCurrentActCtx (in: lphActCtx=0x19e9b0 | out: lphActCtx=0x19e9b0*=0x689cf4) returned 1 [0184.075] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0184.075] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0184.076] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.141b42a_r10_ad1", lpWindowName="&Quit", dwStyle=0x5601000b, X=330, Y=94, nWidth=100, nHeight=23, hWndParent=0xb004c, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x30328 [0184.076] SetWindowLongW (hWnd=0x30328, nIndex=-4, dwNewLong=1862787184) returned 76692126 [0184.076] GetWindowLongW (hWnd=0x30328, nIndex=-4) returned 1862787184 [0184.077] SetWindowLongW (hWnd=0x30328, nIndex=-4, dwNewLong=76692606) returned 1862787184 [0184.077] GetWindowLongW (hWnd=0x30328, nIndex=-4) returned 76692606 [0184.077] GetWindowLongW (hWnd=0x30328, nIndex=-16) returned 1174470667 [0184.077] GetWindowLongW (hWnd=0x30328, nIndex=-12) returned 0 [0184.077] SetWindowLongW (hWnd=0x30328, nIndex=-12, dwNewLong=197416) returned 0 [0184.077] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x81, wParam=0x0, lParam=0x19e3d0) returned 0x1 [0184.078] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x83, wParam=0x0, lParam=0x19e3bc) returned 0x0 [0184.078] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x1, wParam=0x0, lParam=0x19e3d0) returned 0x0 [0184.080] SendMessageW (hWnd=0x30328, Msg=0x2055, wParam=0x30328, lParam=0x3) returned 0x2 [0184.080] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3 [0184.080] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0 [0184.080] GetWindow (hWnd=0x30328, uCmd=0x3) returned 0x5028a [0184.080] GetClientRect (in: hWnd=0x30328, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1 [0184.080] GetWindowRect (in: hWnd=0x30328, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1 [0184.080] GetParent (hWnd=0x30328) returned 0xb004c [0184.080] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0b4, cPoints=0x2 | out: lpPoints=0x19e0b4) returned -24773109 [0184.080] SetWindowTextW (hWnd=0x30328, lpString="&Quit") returned 1 [0184.080] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0xc, wParam=0x0, lParam=0x232e258) returned 0x1 [0184.081] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0 [0184.081] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x3, wParam=0x0, lParam=0x5e014a) returned 0x0 [0184.081] GetClientRect (in: hWnd=0x30328, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1 [0184.081] GetWindowRect (in: hWnd=0x30328, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1 [0184.081] GetParent (hWnd=0x30328) returned 0xb004c [0184.081] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e10c, cPoints=0x2 | out: lpPoints=0x19e10c) returned -24773109 [0184.082] SendMessageW (hWnd=0x30328, Msg=0x2210, wParam=0x3280001, lParam=0x30328) returned 0x0 [0184.082] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x2210, wParam=0x3280001, lParam=0x30328) returned 0x0 [0184.082] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0184.082] GetParent (hWnd=0x30328) returned 0xb004c [0184.082] GetCurrentActCtx (in: lphActCtx=0x19e98c | out: lphActCtx=0x19e98c*=0x689cf4) returned 1 [0184.083] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0184.083] GetClassInfoW (in: hInstance=0x0, lpClassName="EDIT", lpWndClass=0x233098c | out: lpWndClass=0x233098c) returned 1 [0184.084] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0184.084] CoTaskMemAlloc (cb=0x54) returned 0x705890 [0184.084] RegisterClassW (lpWndClass=0x19e844) returned 0xc20d [0184.084] CoTaskMemFree (pv=0x705890) [0184.085] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0184.085] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r10_ad1", lpWindowName="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 192.30.89.67:11344\r\n at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)\r\n at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)\r\n --- End of inner exception stack trace ---\r\n at System.Net.WebClient.UploadValues(Uri address, String method, NameValueCollection data)\r\n at System.Net.WebClient.UploadValues(String address, String method, NameValueCollection data)\r\n at eda2.Form1.GetPublicKey(String url)\r\n at eda2.Form1.StartAction()\r\n at eda2.Form1.Form1_Load(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Form.OnCreateControl()\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.ScrollableControl.WndProc(Message& m)\r\n at System.Windows.Forms.Form.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Form.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll\r\n----------------------------------------\r\nnotepad\r\n Assembly Version: 2.1.0.0\r\n Win32 Version: 2.1.0.0\r\n CodeBase: file:///C:/Users/RDHJ0C~1/AppData/Local/Temp/svhost.exe\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Core\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll\r\n----------------------------------------\r\nSystem.Configuration\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll\r\n----------------------------------------\r\nSystem.Xml\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n", dwStyle=0x563008c4, X=8, Y=125, nWidth=422, nHeight=154, hWndParent=0xb004c, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x60248 [0184.085] SetWindowLongW (hWnd=0x60248, nIndex=-4, dwNewLong=1862779696) returned 76692686 [0184.085] GetWindowLongW (hWnd=0x60248, nIndex=-4) returned 1862779696 [0184.086] SetWindowLongW (hWnd=0x60248, nIndex=-4, dwNewLong=76692726) returned 1862779696 [0184.086] GetWindowLongW (hWnd=0x60248, nIndex=-4) returned 76692726 [0184.086] GetWindowLongW (hWnd=0x60248, nIndex=-16) returned 1177553092 [0184.086] GetWindowLongW (hWnd=0x60248, nIndex=-12) returned 0 [0184.086] SetWindowLongW (hWnd=0x60248, nIndex=-12, dwNewLong=393800) returned 0 [0184.086] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x81, wParam=0x0, lParam=0x19e3b0) returned 0x1 [0184.088] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x83, wParam=0x0, lParam=0x19e39c) returned 0x0 [0184.091] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x1, wParam=0x0, lParam=0x19e3b0) returned 0x1 [0184.175] GetWindow (hWnd=0x60248, uCmd=0x3) returned 0x30328 [0184.175] GetClientRect (in: hWnd=0x60248, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1 [0184.175] GetWindowRect (in: hWnd=0x60248, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1 [0184.175] GetParent (hWnd=0x60248) returned 0xb004c [0184.175] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0b4, cPoints=0x2 | out: lpPoints=0x19e0b4) returned -24773109 [0184.175] GetWindowTextLengthW (hWnd=0xb004c) returned 24 [0184.175] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0184.176] GetSystemMetrics (nIndex=42) returned 0 [0184.176] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19df34, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0184.176] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19df34) returned 0x18 [0184.176] SendMessageW (hWnd=0x60248, Msg=0x30, wParam=0x3a0a09ab, lParam=0x0) returned 0x1 [0184.176] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x30, wParam=0x3a0a09ab, lParam=0x0) returned 0x1 [0184.194] SetWindowTextW (hWnd=0x60248, lpString="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 192.30.89.67:11344\r\n at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)\r\n at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)\r\n --- End of inner exception stack trace ---\r\n at System.Net.WebClient.UploadValues(Uri address, String method, NameValueCollection data)\r\n at System.Net.WebClient.UploadValues(String address, String method, NameValueCollection data)\r\n at eda2.Form1.GetPublicKey(String url)\r\n at eda2.Form1.StartAction()\r\n at eda2.Form1.Form1_Load(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Form.OnCreateControl()\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.ScrollableControl.WndProc(Message& m)\r\n at System.Windows.Forms.Form.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Form.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll\r\n----------------------------------------\r\nnotepad\r\n Assembly Version: 2.1.0.0\r\n Win32 Version: 2.1.0.0\r\n CodeBase: file:///C:/Users/RDHJ0C~1/AppData/Local/Temp/svhost.exe\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Core\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll\r\n----------------------------------------\r\nSystem.Configuration\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll\r\n----------------------------------------\r\nSystem.Xml\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n") returned 1 [0184.194] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xc, wParam=0x0, lParam=0x232ab1c) returned 0x1 [0184.196] GetSystemMetrics (nIndex=5) returned 1 [0184.196] GetSystemMetrics (nIndex=6) returned 1 [0184.196] SendMessageW (hWnd=0x60248, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0184.197] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1 [0184.201] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x5, wParam=0x0, lParam=0x850191) returned 0x1 [0184.201] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x3, wParam=0x0, lParam=0x7f000a) returned 0x0 [0184.201] GetClientRect (in: hWnd=0x60248, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1 [0184.201] GetWindowRect (in: hWnd=0x60248, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1 [0184.201] GetParent (hWnd=0x60248) returned 0xb004c [0184.201] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e10c, cPoints=0x2 | out: lpPoints=0x19e10c) returned -24773109 [0184.202] SendMessageW (hWnd=0x60248, Msg=0x2210, wParam=0x2480001, lParam=0x60248) returned 0x0 [0184.202] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x2210, wParam=0x2480001, lParam=0x60248) returned 0x0 [0184.202] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0184.202] GetParent (hWnd=0x60248) returned 0xb004c [0184.202] GetWindowLongW (hWnd=0xb004c, nIndex=-8) returned 0 [0184.202] GetCursorPos (in: lpPoint=0x2330df8 | out: lpPoint=0x2330df8*(x=1155, y=87)) returned 1 [0184.202] MonitorFromPoint (pt=0x106, dwFlags=0x333) returned 0x10001 [0184.203] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e8c0 | out: lpmi=0x19e8c0) returned 1 [0184.203] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x190105e1 [0184.203] GetDeviceCaps (hdc=0x190105e1, index=12) returned 32 [0184.203] GetDeviceCaps (hdc=0x190105e1, index=14) returned 1 [0184.203] DeleteDC (hdc=0x190105e1) returned 1 [0184.203] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e914 | out: lpmi=0x19e914) returned 1 [0184.203] GetWindowThreadProcessId (in: hWnd=0xb004c, lpdwProcessId=0x19e9c4 | out: lpdwProcessId=0x19e9c4) returned 0xbf8 [0184.203] GetCurrentThreadId () returned 0xbf8 [0184.204] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc20e [0184.204] PostMessageW (hWnd=0xb004c, Msg=0xc20e, wParam=0x0, lParam=0x0) returned 1 [0184.204] GetWindowTextLengthW (hWnd=0xb004c) returned 24 [0184.204] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0184.205] GetSystemMetrics (nIndex=42) returned 0 [0184.205] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19e91c, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0184.205] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19e91c) returned 0x18 [0184.205] GdipImageGetFrameDimensionsCount (image=0x5b3f598, count=0x19e920) returned 0x0 [0184.206] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x6e4520 [0184.206] GdipImageGetFrameDimensionsList (image=0x5b3f598, dimensionIDs=0x6e4520*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0 [0184.208] LocalFree (hMem=0x6e4520) returned 0x0 [0184.398] GdipImageGetFrameDimensionsCount (image=0x5b47f18, count=0x19e914) returned 0x0 [0184.398] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x6e45b0 [0184.398] GdipImageGetFrameDimensionsList (image=0x5b47f18, dimensionIDs=0x6e45b0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0 [0184.398] LocalFree (hMem=0x6e45b0) returned 0x0 [0184.398] SystemParametersInfoW (in: uiAction=0x5f, uiParam=0x0, pvParam=0x19ea5c, fWinIni=0x0 | out: pvParam=0x19ea5c) returned 1 [0184.400] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19ed94) returned 0x0 [0184.413] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0184.414] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0184.414] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0184.414] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0184.415] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19eb20 | out: lpwndpl=0x19eb20) returned 1 [0184.415] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eacc | out: lpRect=0x19eacc) returned 1 [0184.415] GetWindowTextLengthW (hWnd=0xb004c) returned 24 [0184.415] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0184.415] GetSystemMetrics (nIndex=42) returned 0 [0184.415] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19e970, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0184.415] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19e970) returned 0x18 [0184.416] GetClientRect (in: hWnd=0xb004c, lpRect=0x19e9d4 | out: lpRect=0x19e9d4) returned 1 [0184.416] GetCurrentObject (hdc=0x50107d3, type=0x1) returned 0x1b00017 [0184.416] GetCurrentObject (hdc=0x50107d3, type=0x2) returned 0x1900010 [0184.416] GetCurrentObject (hdc=0x50107d3, type=0x7) returned 0x670509b5 [0184.416] GetCurrentObject (hdc=0x50107d3, type=0x6) returned 0x18a0048 [0184.416] SaveDC (hdc=0x50107d3) returned 1 [0184.416] GetNearestColor (hdc=0x50107d3, color=0xf0f0f0) returned 0xf0f0f0 [0184.416] CreateSolidBrush (color=0xf0f0f0) returned 0x101008ec [0184.416] FillRect (hDC=0x50107d3, lprc=0x19e874, hbr=0x101008ec) returned 1 [0184.416] DeleteObject (ho=0x101008ec) returned 1 [0184.416] RestoreDC (hdc=0x50107d3, nSavedDC=-1) returned 1 [0184.417] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0184.417] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0184.417] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0184.417] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x14, wParam=0x110106ca, lParam=0x0) returned 0x1 [0184.417] GetStockObject (i=5) returned 0x1900015 [0184.418] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0184.418] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x14, wParam=0x50107d3, lParam=0x0) returned 0x1 [0184.418] GetStockObject (i=5) returned 0x1900015 [0184.418] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0184.418] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x14, wParam=0x110106ca, lParam=0x0) returned 0x1 [0184.418] GetStockObject (i=5) returned 0x1900015 [0184.418] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19eb20 | out: lpwndpl=0x19eb20) returned 1 [0184.419] GetClientRect (in: hWnd=0x802a2, lpRect=0x19eacc | out: lpRect=0x19eacc) returned 1 [0184.419] GetWindowTextLengthW (hWnd=0x802a2) returned 7 [0184.419] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0184.419] GetSystemMetrics (nIndex=42) returned 0 [0184.419] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e994, nMaxCount=8 | out: lpString="notepad") returned 7 [0184.419] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e994) returned 0x7 [0184.419] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e9d4 | out: lpRect=0x19e9d4) returned 1 [0184.419] GetCurrentObject (hdc=0x9010784, type=0x1) returned 0x1b00017 [0184.419] GetCurrentObject (hdc=0x9010784, type=0x2) returned 0x1900010 [0184.419] GetCurrentObject (hdc=0x9010784, type=0x7) returned 0x360506d2 [0184.419] GetCurrentObject (hdc=0x9010784, type=0x6) returned 0x18a0048 [0184.419] SaveDC (hdc=0x9010784) returned 1 [0184.419] GetNearestColor (hdc=0x9010784, color=0xf0f0f0) returned 0xf0f0f0 [0184.419] CreateSolidBrush (color=0xf0f0f0) returned 0x111008ec [0184.419] FillRect (hDC=0x9010784, lprc=0x19e874, hbr=0x111008ec) returned 1 [0184.420] DeleteObject (ho=0x111008ec) returned 1 [0184.420] RestoreDC (hdc=0x9010784, nSavedDC=-1) returned 1 [0184.421] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19eb04 | out: lpwndpl=0x19eb04) returned 1 [0184.421] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x47, wParam=0x0, lParam=0x19ed94) returned 0x0 [0184.421] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eab4 | out: lpRect=0x19eab4) returned 1 [0184.421] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eab4 | out: lpRect=0x19eab4) returned 1 [0184.422] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0184.422] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0184.422] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0184.423] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x5, wParam=0x0, lParam=0x7d01b6) returned 0x0 [0184.423] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x3, wParam=0x0, lParam=0x17b01f5) returned 0x0 [0184.423] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eae4 | out: lpRect=0x19eae4) returned 1 [0184.423] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eae4 | out: lpRect=0x19eae4) returned 1 [0184.424] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1 [0184.424] InvalidateRect (hWnd=0x701de, lpRect=0x0, bErase=0) returned 1 [0184.424] GetFocus () returned 0xb004c [0184.424] GetFocus () returned 0xb004c [0184.425] SetFocus (hWnd=0x701de) returned 0xb004c [0184.425] GetFocus () returned 0x701de [0184.425] IsChild (hWndParent=0xb004c, hWnd=0x701de) returned 1 [0184.425] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x8, wParam=0x701de, lParam=0x0) returned 0x0 [0184.425] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0184.490] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0184.491] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0184.491] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x7, wParam=0xb004c, lParam=0x0) returned 0x0 [0184.493] GetStockObject (i=5) returned 0x1900015 [0184.495] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8 [0184.495] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0xd, wParam=0x9, lParam=0x704cc0) returned 0x8 [0184.497] GetDlgItem (hDlg=0xb004c, nIDDlgItem=459230) returned 0x701de [0184.497] SendMessageW (hWnd=0x701de, Msg=0x202b, wParam=0x701de, lParam=0x19e824) returned 0x0 [0184.497] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x202b, wParam=0x701de, lParam=0x19e824) returned 0x0 [0184.497] InvalidateRect (hWnd=0x701de, lpRect=0x0, bErase=0) returned 1 [0184.497] GetFocus () returned 0x701de [0184.498] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.498] IsWindowUnicode (hWnd=0x802a2) returned 1 [0184.498] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.501] TranslateMessage (lpMsg=0x19ee84) returned 0 [0184.501] DispatchMessageW (lpMsg=0x19ee84) returned 0x0 [0184.502] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x46, wParam=0x0, lParam=0x19ec24) returned 0x0 [0184.502] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x83, wParam=0x1, lParam=0x19ebfc) returned 0x0 [0184.546] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0184.549] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19e9b0 | out: lpwndpl=0x19e9b0) returned 1 [0184.549] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e95c | out: lpRect=0x19e95c) returned 1 [0184.549] GetWindowTextLengthW (hWnd=0x802a2) returned 7 [0184.549] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0184.549] GetSystemMetrics (nIndex=42) returned 0 [0184.549] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e824, nMaxCount=8 | out: lpString="notepad") returned 7 [0184.549] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e824) returned 0x7 [0184.549] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e864 | out: lpRect=0x19e864) returned 1 [0184.549] GetCurrentObject (hdc=0x9010784, type=0x1) returned 0x1b00017 [0184.549] GetCurrentObject (hdc=0x9010784, type=0x2) returned 0x1900010 [0184.550] GetCurrentObject (hdc=0x9010784, type=0x7) returned 0x360506d2 [0184.550] GetCurrentObject (hdc=0x9010784, type=0x6) returned 0x18a0048 [0184.550] SaveDC (hdc=0x9010784) returned 1 [0184.550] GetNearestColor (hdc=0x9010784, color=0xf0f0f0) returned 0xf0f0f0 [0184.550] CreateSolidBrush (color=0xf0f0f0) returned 0x121008ec [0184.550] FillRect (hDC=0x9010784, lprc=0x19e704, hbr=0x121008ec) returned 1 [0184.550] DeleteObject (ho=0x121008ec) returned 1 [0184.556] RestoreDC (hdc=0x9010784, nSavedDC=-1) returned 1 [0184.556] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19e994 | out: lpwndpl=0x19e994) returned 1 [0184.557] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x47, wParam=0x0, lParam=0x19ec24) returned 0x0 [0184.557] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e944 | out: lpRect=0x19e944) returned 1 [0184.557] GetWindowRect (in: hWnd=0x802a2, lpRect=0x19e944 | out: lpRect=0x19e944) returned 1 [0184.559] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x83, wParam=0x1, lParam=0x19e774) returned 0x0 [0184.560] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0184.562] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19e528 | out: lpwndpl=0x19e528) returned 1 [0184.562] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e4d4 | out: lpRect=0x19e4d4) returned 1 [0184.562] GetWindowTextLengthW (hWnd=0x802a2) returned 7 [0184.562] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0184.562] GetSystemMetrics (nIndex=42) returned 0 [0184.562] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e39c, nMaxCount=8 | out: lpString="notepad") returned 7 [0184.562] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e39c) returned 0x7 [0184.562] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e3dc | out: lpRect=0x19e3dc) returned 1 [0184.562] GetCurrentObject (hdc=0x50107d3, type=0x1) returned 0x1b00017 [0184.562] GetCurrentObject (hdc=0x50107d3, type=0x2) returned 0x1900010 [0184.562] GetCurrentObject (hdc=0x50107d3, type=0x7) returned 0x360506d2 [0184.562] GetCurrentObject (hdc=0x50107d3, type=0x6) returned 0x18a0048 [0184.562] SaveDC (hdc=0x50107d3) returned 1 [0184.562] GetNearestColor (hdc=0x50107d3, color=0xf0f0f0) returned 0xf0f0f0 [0184.562] CreateSolidBrush (color=0xf0f0f0) returned 0x131008ec [0184.562] FillRect (hDC=0x50107d3, lprc=0x19e27c, hbr=0x131008ec) returned 1 [0184.593] DeleteObject (ho=0x131008ec) returned 1 [0184.593] RestoreDC (hdc=0x50107d3, nSavedDC=-1) returned 1 [0184.594] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0184.594] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.594] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x60) returned 0x0 [0184.596] IsWindowUnicode (hWnd=0x7032c) returned 1 [0184.596] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.596] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x60) returned 0x0 [0184.597] TranslateMessage (lpMsg=0x19ee84) returned 0 [0184.597] DispatchMessageW (lpMsg=0x19ee84) returned 0x0 [0184.597] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0184.597] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.597] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x60) returned 0x0 [0184.598] IsWindowUnicode (hWnd=0xb004c) returned 1 [0184.598] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.598] TranslateMessage (lpMsg=0x19ee84) returned 0 [0184.598] DispatchMessageW (lpMsg=0x19ee84) returned 0x0 [0184.606] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0184.606] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.606] IsWindowUnicode (hWnd=0xb004c) returned 1 [0184.606] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.606] TranslateMessage (lpMsg=0x19ee84) returned 0 [0184.607] DispatchMessageW (lpMsg=0x19ee84) returned 0x0 [0184.607] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.608] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1 [0184.609] IsWindowUnicode (hWnd=0x5028a) returned 1 [0184.609] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.609] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1 [0184.611] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0184.611] SetCursor (hCursor=0x10003) returned 0x10007 [0184.611] TranslateMessage (lpMsg=0x19ee84) returned 0 [0184.612] DispatchMessageW (lpMsg=0x19ee84) returned 0x0 [0184.637] _TrackMouseEvent (in: lpEventTrack=0x2332200 | out: lpEventTrack=0x2332200) returned 1 [0184.637] SendMessageW (hWnd=0x5028a, Msg=0xc1d1, wParam=0x0, lParam=0x0) returned 0x0 [0184.637] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0xc1d1, wParam=0x0, lParam=0x0) returned 0x0 [0184.768] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1 [0184.769] GetKeyState (nVirtKey=1) returned 0 [0184.769] GetKeyState (nVirtKey=2) returned 0 [0184.769] GetKeyState (nVirtKey=4) returned 0 [0184.769] GetKeyState (nVirtKey=5) returned 0 [0184.769] GetKeyState (nVirtKey=6) returned 0 [0184.769] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.769] IsWindowUnicode (hWnd=0xb004c) returned 1 [0184.769] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.769] TranslateMessage (lpMsg=0x19ee84) returned 0 [0184.769] DispatchMessageW (lpMsg=0x19ee84) returned 0x0 [0184.770] BeginPaint (in: hWnd=0xb004c, lpPaint=0x19e94c | out: lpPaint=0x19e94c) returned 0x9010784 [0184.771] GdipCreateHalftonePalette () returned 0x6e0806d0 [0184.772] SelectPalette (hdc=0x9010784, hPal=0x6e0806d0, bForceBkgd=1) returned 0x188000b [0184.772] GetWindowTextLengthW (hWnd=0xb004c) returned 24 [0184.772] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0184.772] GetSystemMetrics (nIndex=42) returned 0 [0184.772] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19e8c0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0184.772] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19e8c0) returned 0x18 [0184.772] SelectPalette (hdc=0x9010784, hPal=0x188000b, bForceBkgd=0) returned 0x6e0806d0 [0184.773] EndPaint (hWnd=0xb004c, lpPaint=0x19e948) returned 1 [0184.773] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.773] IsWindowUnicode (hWnd=0x3031c) returned 1 [0184.773] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.773] TranslateMessage (lpMsg=0x19ee84) returned 0 [0184.773] DispatchMessageW (lpMsg=0x19ee84) returned 0x0 [0184.773] BeginPaint (in: hWnd=0x3031c, lpPaint=0x19e96c | out: lpPaint=0x19e96c) returned 0x50107d3 [0184.774] SelectPalette (hdc=0x50107d3, hPal=0x6e0806d0, bForceBkgd=1) returned 0x188000b [0184.776] CreateCompatibleDC (hdc=0x50107d3) returned 0x770109d5 [0184.776] GetObjectType (h=0x50107d3) returned 0x3 [0184.776] CreateCompatibleBitmap (hdc=0x50107d3, cx=1, cy=1) returned 0x480509ad [0184.777] GetDIBits (in: hdc=0x50107d3, hbm=0x480509ad, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x19e45c, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e45c) returned 1 [0184.777] GetDIBits (in: hdc=0x50107d3, hbm=0x480509ad, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x19e45c, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e45c) returned 1 [0184.777] DeleteObject (ho=0x480509ad) returned 1 [0184.777] CreateDIBSection (in: hdc=0x50107d3, lpbmi=0x19e4ac, usage=0x0, ppvBits=0x19e9a0, hSection=0x0, offset=0x0 | out: ppvBits=0x19e9a0) returned 0x3e0506d6 [0184.778] SelectObject (hdc=0x770109d5, h=0x3e0506d6) returned 0x185000f [0184.778] GdipCreateFromHDC (hdc=0x770109d5, graphics=0x19e984) returned 0x0 [0184.779] GdipTranslateWorldTransform (graphics=0x5b3f268, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0184.779] GdipSetClipRectI (graphics=0x5b3f268, x=0, y=0, width=64, height=64, combineMode=0x0) returned 0x0 [0184.783] GdipCreateMatrix (matrix=0x19e9cc) returned 0x0 [0184.783] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b46b80) returned 0x0 [0184.783] GdipIsMatrixIdentity (matrix=0x5b46b80, result=0x19e9e4) returned 0x0 [0184.783] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee050 [0184.784] GdipGetMatrixElements (matrix=0x5b46b80, matrixOut=0x6ee050) returned 0x0 [0184.784] LocalFree (hMem=0x6ee050) returned 0x0 [0184.785] GdipDeleteMatrix (matrix=0x5b46b80) returned 0x0 [0184.785] GdipCreateRegion (region=0x19e9cc) returned 0x0 [0184.785] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0 [0184.786] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e9d8) returned 0x0 [0184.786] GdipSaveGraphics (graphics=0x5b3f268, state=0x19ea04) returned 0x0 [0184.786] GetWindowTextLengthW (hWnd=0x3031c) returned 0 [0184.786] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0184.786] GetSystemMetrics (nIndex=42) returned 0 [0184.786] GetWindowTextW (in: hWnd=0x3031c, lpString=0x19e91c, nMaxCount=1 | out: lpString="") returned 0 [0184.786] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xd, wParam=0x1, lParam=0x19e91c) returned 0x0 [0184.787] GetClientRect (in: hWnd=0x3031c, lpRect=0x19e9cc | out: lpRect=0x19e9cc) returned 1 [0184.787] GdipCreateRegion (region=0x19e820) returned 0x0 [0184.787] GdipGetClip (graphics=0x5b3f268, region=0x5b46bf0) returned 0x0 [0184.787] GdipCreateMatrix (matrix=0x19e820) returned 0x0 [0184.787] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b40a08) returned 0x0 [0184.788] GdipIsMatrixIdentity (matrix=0x5b40a08, result=0x19e838) returned 0x0 [0184.788] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee0f8 [0184.788] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6ee0f8) returned 0x0 [0184.788] LocalFree (hMem=0x6ee0f8) returned 0x0 [0184.790] GdipCombineRegionRegion (region=0x5b46bf0, region2=0x5b48418, combineMode=0x1) returned 0x0 [0184.790] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee088 [0184.790] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6ee088) returned 0x0 [0184.790] LocalFree (hMem=0x6ee088) returned 0x0 [0184.791] GdipDeleteMatrix (matrix=0x5b40a08) returned 0x0 [0184.791] GdipIsInfiniteRegion (region=0x5b46bf0, graphics=0x5b3f268, result=0x19e860) returned 0x0 [0184.791] GdipIsInfiniteRegion (region=0x5b46bf0, graphics=0x5b3f268, result=0x19e850) returned 0x0 [0184.791] GdipGetRegionHRgn (region=0x5b46bf0, graphics=0x5b3f268, hRgn=0x19e850) returned 0x0 [0184.793] GdipDeleteRegion (region=0x5b46bf0) returned 0x0 [0184.793] GdipGetDC (graphics=0x5b3f268, hdc=0x19e868) returned 0x0 [0184.793] GetCurrentObject (hdc=0x770109d5, type=0x1) returned 0x1b00017 [0184.793] GetCurrentObject (hdc=0x770109d5, type=0x2) returned 0x1900010 [0184.793] GetCurrentObject (hdc=0x770109d5, type=0x7) returned 0x3e0506d6 [0184.793] GetCurrentObject (hdc=0x770109d5, type=0x6) returned 0x18a0048 [0184.793] SaveDC (hdc=0x770109d5) returned 1 [0184.794] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1f04087b [0184.794] GetClipRgn (hdc=0x770109d5, hrgn=0x1f04087b) returned 0 [0184.794] SelectClipRgn (hdc=0x770109d5, hrgn=0x5c0406cc) returned 2 [0184.794] DeleteObject (ho=0x1f04087b) returned 1 [0184.794] DeleteObject (ho=0x5c0406cc) returned 1 [0184.796] OffsetViewportOrgEx (in: hdc=0x770109d5, x=0, y=0, lppt=0x23338e4 | out: lppt=0x23338e4) returned 1 [0184.797] GetNearestColor (hdc=0x770109d5, color=0xf0f0f0) returned 0xf0f0f0 [0184.798] CreateSolidBrush (color=0xf0f0f0) returned 0x141008ec [0184.798] FillRect (hDC=0x770109d5, lprc=0x19e86c, hbr=0x141008ec) returned 1 [0184.798] DeleteObject (ho=0x141008ec) returned 1 [0184.798] RestoreDC (hdc=0x770109d5, nSavedDC=-1) returned 1 [0184.799] GdipReleaseDC (graphics=0x5b3f268, hdc=0x770109d5) returned 0x0 [0184.818] GdipRestoreGraphics (graphics=0x5b3f268, state=0xfdb40dbd) returned 0x0 [0184.818] GdipDeleteRegion (region=0x5b48418) returned 0x0 [0184.819] GetWindowTextLengthW (hWnd=0x3031c) returned 0 [0184.819] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0184.819] GetSystemMetrics (nIndex=42) returned 0 [0184.819] GetWindowTextW (in: hWnd=0x3031c, lpString=0x19e91c, nMaxCount=1 | out: lpString="") returned 0 [0184.819] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xd, wParam=0x1, lParam=0x19e91c) returned 0x0 [0184.819] GdipGetImageWidth (image=0x5b3f598, width=0x19e8b4) returned 0x0 [0184.819] GdipGetImageHeight (image=0x5b3f598, height=0x19e8b4) returned 0x0 [0184.820] GdipGetImageWidth (image=0x5b3f598, width=0x19e8a0) returned 0x0 [0184.820] GdipGetImageHeight (image=0x5b3f598, height=0x19e8a0) returned 0x0 [0184.820] GdipDrawImageRectI (graphics=0x5b3f268, image=0x5b3f598, x=16, y=16, width=32, height=32) returned 0x0 [0184.821] GdipGetDC (graphics=0x5b3f268, hdc=0x19e9c4) returned 0x0 [0184.822] BitBlt (hdc=0x50107d3, x=0, y=0, cx=64, cy=64, hdcSrc=0x770109d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0184.822] GdipReleaseDC (graphics=0x5b3f268, hdc=0x770109d5) returned 0x0 [0184.822] SelectPalette (hdc=0x50107d3, hPal=0x188000b, bForceBkgd=0) returned 0x6e0806d0 [0184.823] SelectObject (hdc=0x770109d5, h=0x185000f) returned 0x3e0506d6 [0184.823] DeleteDC (hdc=0x770109d5) returned 1 [0184.823] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0 [0184.823] EndPaint (hWnd=0x3031c, lpPaint=0x19e968) returned 1 [0184.823] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.824] IsWindowUnicode (hWnd=0x801f0) returned 1 [0184.824] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.824] TranslateMessage (lpMsg=0x19ee84) returned 0 [0184.824] DispatchMessageW (lpMsg=0x19ee84) returned 0x0 [0184.824] BeginPaint (in: hWnd=0x801f0, lpPaint=0x19e930 | out: lpPaint=0x19e930) returned 0xd001053c [0184.824] SelectPalette (hdc=0xd001053c, hPal=0x6e0806d0, bForceBkgd=1) returned 0x188000b [0184.824] CreateCompatibleDC (hdc=0xd001053c) returned 0x790109d5 [0184.825] GetObjectType (h=0xd001053c) returned 0x3 [0184.825] CreateCompatibleBitmap (hdc=0xd001053c, cx=1, cy=1) returned 0x430506dd [0184.825] GetDIBits (in: hdc=0xd001053c, hbm=0x430506dd, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x19e3e0, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e3e0) returned 1 [0184.825] GetDIBits (in: hdc=0xd001053c, hbm=0x430506dd, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x19e3e0, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e3e0) returned 1 [0184.825] DeleteObject (ho=0x430506dd) returned 1 [0184.825] CreateDIBSection (in: hdc=0xd001053c, lpbmi=0x19e430, usage=0x0, ppvBits=0x19e924, hSection=0x0, offset=0x0 | out: ppvBits=0x19e924) returned 0x660506c7 [0184.825] SelectObject (hdc=0x790109d5, h=0x660506c7) returned 0x185000f [0184.826] GdipCreateFromHDC (hdc=0x790109d5, graphics=0x19e908) returned 0x0 [0184.826] GdipTranslateWorldTransform (graphics=0x5b3f268, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0184.826] GdipSetClipRectI (graphics=0x5b3f268, x=0, y=0, width=354, height=68, combineMode=0x0) returned 0x0 [0184.826] GdipCreateMatrix (matrix=0x19e990) returned 0x0 [0184.826] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b46b80) returned 0x0 [0184.826] GdipIsMatrixIdentity (matrix=0x5b46b80, result=0x19e9a8) returned 0x0 [0184.826] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ede58 [0184.826] GdipGetMatrixElements (matrix=0x5b46b80, matrixOut=0x6ede58) returned 0x0 [0184.827] LocalFree (hMem=0x6ede58) returned 0x0 [0184.827] GdipDeleteMatrix (matrix=0x5b46b80) returned 0x0 [0184.827] GdipCreateRegion (region=0x19e990) returned 0x0 [0184.827] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0 [0184.836] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e99c) returned 0x0 [0184.836] GdipSaveGraphics (graphics=0x5b3f268, state=0x19e9c8) returned 0x0 [0184.836] GetWindowTextLengthW (hWnd=0x801f0) returned 242 [0184.836] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xf2 [0184.837] GetSystemMetrics (nIndex=42) returned 0 [0184.837] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19e6fc, nMaxCount=243 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.") returned 242 [0184.837] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0xf3, lParam=0x19e6fc) returned 0xf2 [0184.837] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e990 | out: lpRect=0x19e990) returned 1 [0184.837] GdipCreateRegion (region=0x19e7e4) returned 0x0 [0184.837] GdipGetClip (graphics=0x5b3f268, region=0x5b46bf0) returned 0x0 [0184.837] GdipCreateMatrix (matrix=0x19e7e4) returned 0x0 [0184.837] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b40a08) returned 0x0 [0184.837] GdipIsMatrixIdentity (matrix=0x5b40a08, result=0x19e7fc) returned 0x0 [0184.837] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6edec8 [0184.837] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6edec8) returned 0x0 [0184.838] LocalFree (hMem=0x6edec8) returned 0x0 [0184.838] GdipCombineRegionRegion (region=0x5b46bf0, region2=0x5b48418, combineMode=0x1) returned 0x0 [0184.838] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6edf00 [0184.838] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6edf00) returned 0x0 [0184.838] LocalFree (hMem=0x6edf00) returned 0x0 [0184.838] GdipDeleteMatrix (matrix=0x5b40a08) returned 0x0 [0184.838] GdipIsInfiniteRegion (region=0x5b46bf0, graphics=0x5b3f268, result=0x19e824) returned 0x0 [0184.838] GdipIsInfiniteRegion (region=0x5b46bf0, graphics=0x5b3f268, result=0x19e814) returned 0x0 [0184.839] GdipGetRegionHRgn (region=0x5b46bf0, graphics=0x5b3f268, hRgn=0x19e814) returned 0x0 [0184.839] GdipDeleteRegion (region=0x5b46bf0) returned 0x0 [0184.839] GdipGetDC (graphics=0x5b3f268, hdc=0x19e82c) returned 0x0 [0184.839] GetCurrentObject (hdc=0x790109d5, type=0x1) returned 0x1b00017 [0184.839] GetCurrentObject (hdc=0x790109d5, type=0x2) returned 0x1900010 [0184.839] GetCurrentObject (hdc=0x790109d5, type=0x7) returned 0x660506c7 [0184.839] GetCurrentObject (hdc=0x790109d5, type=0x6) returned 0x18a0048 [0184.839] SaveDC (hdc=0x790109d5) returned 1 [0184.839] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5d0406cc [0184.839] GetClipRgn (hdc=0x790109d5, hrgn=0x5d0406cc) returned 0 [0184.839] SelectClipRgn (hdc=0x790109d5, hrgn=0x2004087b) returned 2 [0184.840] DeleteObject (ho=0x5d0406cc) returned 1 [0184.840] DeleteObject (ho=0x2004087b) returned 1 [0184.840] OffsetViewportOrgEx (in: hdc=0x790109d5, x=0, y=0, lppt=0x23352e8 | out: lppt=0x23352e8) returned 1 [0184.840] GetNearestColor (hdc=0x790109d5, color=0xf0f0f0) returned 0xf0f0f0 [0184.840] CreateSolidBrush (color=0xf0f0f0) returned 0x151008ec [0184.840] FillRect (hDC=0x790109d5, lprc=0x19e830, hbr=0x151008ec) returned 1 [0184.841] DeleteObject (ho=0x151008ec) returned 1 [0184.842] RestoreDC (hdc=0x790109d5, nSavedDC=-1) returned 1 [0184.842] GdipReleaseDC (graphics=0x5b3f268, hdc=0x790109d5) returned 0x0 [0184.842] GdipRestoreGraphics (graphics=0x5b3f268, state=0xfdb20dbd) returned 0x0 [0184.842] GdipDeleteRegion (region=0x5b48418) returned 0x0 [0184.842] GetWindowTextLengthW (hWnd=0x801f0) returned 242 [0184.842] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xf2 [0184.842] GetSystemMetrics (nIndex=42) returned 0 [0184.842] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19e6fc, nMaxCount=243 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.") returned 242 [0184.842] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0xf3, lParam=0x19e6fc) returned 0xf2 [0184.842] GdipGetDC (graphics=0x5b3f268, hdc=0x19e84c) returned 0x0 [0184.842] GetCurrentObject (hdc=0x790109d5, type=0x1) returned 0x1b00017 [0184.842] GetCurrentObject (hdc=0x790109d5, type=0x2) returned 0x1900010 [0184.842] GetCurrentObject (hdc=0x790109d5, type=0x7) returned 0x660506c7 [0184.842] GetCurrentObject (hdc=0x790109d5, type=0x6) returned 0x18a0048 [0184.843] SaveDC (hdc=0x790109d5) returned 1 [0184.843] GetNearestColor (hdc=0x790109d5, color=0x0) returned 0x0 [0184.843] RestoreDC (hdc=0x790109d5, nSavedDC=-1) returned 1 [0184.843] GdipReleaseDC (graphics=0x5b3f268, hdc=0x790109d5) returned 0x0 [0184.843] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000 [0184.844] AdjustWindowRectEx (in: lpRect=0x19e770, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e770) returned 1 [0184.856] GdipGetFamilyName (in: family=0x5b350a0, name=0x19e660, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0 [0184.858] CreateCompatibleDC (hdc=0x0) returned 0x640106b0 [0184.858] GetCurrentObject (hdc=0x640106b0, type=0x1) returned 0x1b00017 [0184.858] GetCurrentObject (hdc=0x640106b0, type=0x2) returned 0x1900010 [0184.858] GetCurrentObject (hdc=0x640106b0, type=0x7) returned 0x185000f [0184.858] GetCurrentObject (hdc=0x640106b0, type=0x6) returned 0x18a0048 [0184.858] SaveDC (hdc=0x640106b0) returned 1 [0184.858] GetDeviceCaps (hdc=0x640106b0, index=90) returned 96 [0184.859] CoTaskMemAlloc (cb=0x5c) returned 0x6eb2d8 [0184.859] CreateFontIndirectW (lplf=0x6eb2d8) returned 0x7e0a09e9 [0184.860] CoTaskMemFree (pv=0x6eb2d8) [0184.860] GetObjectW (in: h=0x7e0a09e9, c=92, pv=0x19e638 | out: pv=0x19e638) returned 92 [0184.860] GetCurrentObject (hdc=0x640106b0, type=0x6) returned 0x18a0048 [0184.861] GetObjectW (in: h=0x18a0048, c=92, pv=0x19e590 | out: pv=0x19e590) returned 92 [0184.861] SelectObject (hdc=0x640106b0, h=0x7e0a09e9) returned 0x18a0048 [0184.861] GetMapMode (hdc=0x640106b0) returned 1 [0184.862] GetTextMetricsW (in: hdc=0x640106b0, lptm=0x19e644 | out: lptm=0x19e644) returned 1 [0184.863] DrawTextExW (in: hdc=0x640106b0, lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.", cchText=242, lprc=0x19e758, format=0x102400, lpdtp=0x2335fcc | out: lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.", lprc=0x19e758) returned 39 [0184.864] GdipGetTextRenderingHint (graphics=0x5b3f268, mode=0x19e7ec) returned 0x0 [0184.865] GdipGetDC (graphics=0x5b3f268, hdc=0x19e7d8) returned 0x0 [0184.865] GetCurrentObject (hdc=0x790109d5, type=0x1) returned 0x1b00017 [0184.865] GetCurrentObject (hdc=0x790109d5, type=0x2) returned 0x1900010 [0184.865] GetCurrentObject (hdc=0x790109d5, type=0x7) returned 0x660506c7 [0184.865] GetCurrentObject (hdc=0x790109d5, type=0x6) returned 0x18a0048 [0184.865] SaveDC (hdc=0x790109d5) returned 1 [0184.866] GetTextAlign (hdc=0x790109d5) returned 0x0 [0184.866] GetTextColor (hdc=0x790109d5) returned 0x0 [0184.866] GetCurrentObject (hdc=0x790109d5, type=0x6) returned 0x18a0048 [0184.866] GetObjectW (in: h=0x18a0048, c=92, pv=0x19e4e0 | out: pv=0x19e4e0) returned 92 [0184.867] SelectObject (hdc=0x790109d5, h=0x7e0a09e9) returned 0x18a0048 [0184.867] GetBkMode (hdc=0x790109d5) returned 2 [0184.867] SetBkMode (hdc=0x790109d5, mode=1) returned 2 [0184.867] DrawTextExW (in: hdc=0x790109d5, lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.", cchText=242, lprc=0x19e76c, format=0x102010, lpdtp=0x2336200 | out: lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.", lprc=0x19e76c) returned 65 [0184.873] RestoreDC (hdc=0x790109d5, nSavedDC=-1) returned 1 [0184.874] GdipReleaseDC (graphics=0x5b3f268, hdc=0x790109d5) returned 0x0 [0184.874] GdipGetDC (graphics=0x5b3f268, hdc=0x19e988) returned 0x0 [0184.874] BitBlt (hdc=0xd001053c, x=0, y=0, cx=354, cy=68, hdcSrc=0x790109d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0184.874] GdipReleaseDC (graphics=0x5b3f268, hdc=0x790109d5) returned 0x0 [0184.874] SelectPalette (hdc=0xd001053c, hPal=0x188000b, bForceBkgd=0) returned 0x6e0806d0 [0184.874] SelectObject (hdc=0x790109d5, h=0x185000f) returned 0x660506c7 [0184.874] DeleteDC (hdc=0x790109d5) returned 1 [0184.874] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0 [0184.874] DeleteObject (ho=0x660506c7) returned 1 [0184.875] EndPaint (hWnd=0x801f0, lpPaint=0x19e92c) returned 1 [0184.875] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.876] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1 [0184.885] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0184.885] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0184.885] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0184.888] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19ed5c) returned 0x0 [0184.888] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1 [0184.888] IsWindowUnicode (hWnd=0x5028a) returned 1 [0184.888] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.888] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1 [0184.889] GetDlgItem (hDlg=0xb004c, nIDDlgItem=0) returned 0x0 [0184.889] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x210, wParam=0x201, lParam=0x6400fb) returned 0x0 [0184.889] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x21, wParam=0xb004c, lParam=0x2010001) returned 0x1 [0184.889] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x21, wParam=0xb004c, lParam=0x2010001) returned 0x1 [0184.889] SetCursor (hCursor=0x10003) returned 0x10003 [0184.889] TranslateMessage (lpMsg=0x19ee84) returned 0 [0184.889] DispatchMessageW (lpMsg=0x19ee84) returned 0x0 [0184.889] GetKeyState (nVirtKey=1) returned -127 [0184.890] GetKeyState (nVirtKey=2) returned 0 [0184.890] GetKeyState (nVirtKey=4) returned 0 [0184.890] GetKeyState (nVirtKey=5) returned 0 [0184.890] GetKeyState (nVirtKey=6) returned 0 [0184.890] IsWindowVisible (hWnd=0x5028a) returned 1 [0184.890] IsWindowEnabled (hWnd=0x5028a) returned 1 [0184.890] SetFocus (hWnd=0x5028a) returned 0x701de [0184.891] GetFocus () returned 0x5028a [0184.891] IsChild (hWndParent=0xb004c, hWnd=0x5028a) returned 1 [0184.891] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x8, wParam=0x5028a, lParam=0x0) returned 0x0 [0184.891] GetCapture () returned 0x0 [0184.891] InvalidateRect (hWnd=0x701de, lpRect=0x0, bErase=0) returned 1 [0184.891] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0184.892] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0184.894] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0184.894] InvalidateRect (hWnd=0x701de, lpRect=0x0, bErase=0) returned 1 [0184.894] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1 [0184.894] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x7, wParam=0x701de, lParam=0x0) returned 0x0 [0184.895] GetStockObject (i=5) returned 0x1900015 [0184.895] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9 [0184.895] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0xd, wParam=0xa, lParam=0x704f20) returned 0x9 [0184.895] GetDlgItem (hDlg=0xb004c, nIDDlgItem=328330) returned 0x5028a [0184.895] SendMessageW (hWnd=0x5028a, Msg=0x202b, wParam=0x5028a, lParam=0x19e564) returned 0x0 [0184.895] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x202b, wParam=0x5028a, lParam=0x19e564) returned 0x0 [0184.895] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1 [0184.898] GetFocus () returned 0x5028a [0184.898] GetFocus () returned 0x5028a [0184.898] GetFocus () returned 0x5028a [0184.898] GetKeyState (nVirtKey=1) returned -127 [0184.898] GetKeyState (nVirtKey=2) returned 0 [0184.898] GetKeyState (nVirtKey=4) returned 0 [0184.898] GetKeyState (nVirtKey=5) returned 0 [0184.898] GetKeyState (nVirtKey=6) returned 0 [0184.898] GetCapture () returned 0x0 [0184.899] SetCapture (hWnd=0x5028a) returned 0x0 [0184.899] GetKeyState (nVirtKey=1) returned -127 [0184.899] GetKeyState (nVirtKey=2) returned 0 [0184.899] GetKeyState (nVirtKey=4) returned 0 [0184.899] GetKeyState (nVirtKey=5) returned 0 [0184.899] GetKeyState (nVirtKey=6) returned 0 [0184.899] NotifyWinEvent (event=0x800a, hwnd=0x5028a, idObject=-4, idChild=0) [0184.899] InvalidateRect (hWnd=0x5028a, lpRect=0x19eaf4, bErase=0) returned 1 [0184.900] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.900] IsWindowUnicode (hWnd=0x5028a) returned 1 [0184.900] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1 [0184.901] TranslateMessage (lpMsg=0x19ee84) returned 0 [0184.901] DispatchMessageW (lpMsg=0x19ee84) returned 0x0 [0184.902] MapWindowPoints (in: hWndFrom=0x5028a, hWndTo=0x0, lpPoints=0x2336330, cPoints=0x1 | out: lpPoints=0x2336330) returned 30999254 [0185.073] NotifyWinEvent (event=0x800a, hwnd=0x5028a, idObject=-4, idChild=0) [0185.073] InvalidateRect (hWnd=0x5028a, lpRect=0x19ea98, bErase=0) returned 1 [0185.073] UpdateWindow (hWnd=0x5028a) returned 1 [0185.074] BeginPaint (in: hWnd=0x5028a, lpPaint=0x19e604 | out: lpPaint=0x19e604) returned 0x110106ca [0185.074] SelectPalette (hdc=0x110106ca, hPal=0x6e0806d0, bForceBkgd=1) returned 0x188000b [0185.074] CreateCompatibleDC (hdc=0x110106ca) returned 0x810109d5 [0185.074] DeleteObject (ho=0x3e0506d6) returned 1 [0185.074] GetObjectType (h=0x110106ca) returned 0x3 [0185.074] CreateCompatibleBitmap (hdc=0x110106ca, cx=1, cy=1) returned 0x4a0509ad [0185.074] GetDIBits (in: hdc=0x110106ca, hbm=0x4a0509ad, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x19e0f4, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e0f4) returned 1 [0185.074] GetDIBits (in: hdc=0x110106ca, hbm=0x4a0509ad, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x19e0f4, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e0f4) returned 1 [0185.075] DeleteObject (ho=0x4a0509ad) returned 1 [0185.075] CreateDIBSection (in: hdc=0x110106ca, lpbmi=0x19e144, usage=0x0, ppvBits=0x19e638, hSection=0x0, offset=0x0 | out: ppvBits=0x19e638) returned 0x3f0506d6 [0185.075] SelectObject (hdc=0x810109d5, h=0x3f0506d6) returned 0x185000f [0185.075] GdipCreateFromHDC (hdc=0x810109d5, graphics=0x19e61c) returned 0x0 [0185.075] GdipTranslateWorldTransform (graphics=0x5b3f268, dx=0x0, dy=0x0, order=0x0) returned 0x0 [0185.075] GdipSetClipRectI (graphics=0x5b3f268, x=0, y=0, width=100, height=23, combineMode=0x0) returned 0x0 [0185.075] GdipCreateMatrix (matrix=0x19e664) returned 0x0 [0185.075] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b46b80) returned 0x0 [0185.075] GdipIsMatrixIdentity (matrix=0x5b46b80, result=0x19e67c) returned 0x0 [0185.076] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee018 [0185.076] GdipGetMatrixElements (matrix=0x5b46b80, matrixOut=0x6ee018) returned 0x0 [0185.076] LocalFree (hMem=0x6ee018) returned 0x0 [0185.077] GdipDeleteMatrix (matrix=0x5b46b80) returned 0x0 [0185.077] GdipCreateRegion (region=0x19e664) returned 0x0 [0185.077] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0 [0185.077] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e670) returned 0x0 [0185.077] GdipSaveGraphics (graphics=0x5b3f268, state=0x19e69c) returned 0x0 [0185.077] GdipRestoreGraphics (graphics=0x5b3f268, state=0xfdb00dbd) returned 0x0 [0185.077] GdipDeleteRegion (region=0x5b48418) returned 0x0 [0185.079] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x19e514, fWinIni=0x0 | out: pvParam=0x19e514) returned 1 [0185.079] GdipGetDC (graphics=0x5b3f268, hdc=0x19e47c) returned 0x0 [0185.080] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017 [0185.080] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010 [0185.080] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6 [0185.080] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048 [0185.080] SaveDC (hdc=0x810109d5) returned 1 [0185.080] GetNearestColor (hdc=0x810109d5, color=0xf0f0f0) returned 0xf0f0f0 [0185.080] GetNearestColor (hdc=0x810109d5, color=0xa0a0a0) returned 0xa0a0a0 [0185.080] GetNearestColor (hdc=0x810109d5, color=0x696969) returned 0x696969 [0185.080] GetNearestColor (hdc=0x810109d5, color=0xa0a0a0) returned 0xa0a0a0 [0185.080] GetNearestColor (hdc=0x810109d5, color=0x0) returned 0x0 [0185.080] GetNearestColor (hdc=0x810109d5, color=0xffffff) returned 0xffffff [0185.080] GetNearestColor (hdc=0x810109d5, color=0xe5e5e5) returned 0xe5e5e5 [0185.080] GetNearestColor (hdc=0x810109d5, color=0xd7d7d7) returned 0xd7d7d7 [0185.080] GetNearestColor (hdc=0x810109d5, color=0x0) returned 0x0 [0185.080] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1 [0185.081] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0 [0185.082] IsAppThemed () returned 0x1 [0185.083] GetThemeAppProperties () returned 0x3 [0185.083] GetThemeAppProperties () returned 0x3 [0185.083] OpenThemeData () returned 0x10003 [0185.085] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x19e4e4, fWinIni=0x0 | out: pvParam=0x19e4e4) returned 1 [0185.085] SendMessageW (hWnd=0xb004c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0185.085] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0185.085] IsAppThemed () returned 0x1 [0185.085] GetThemeAppProperties () returned 0x3 [0185.085] GetThemeAppProperties () returned 0x3 [0185.086] DrawTextExW (in: hdc=0x640106b0, lpchText="&Continue", cchText=9, lprc=0x19e338, format=0x102415, lpdtp=0x2337d8c | out: lpchText="&Continue", lprc=0x19e338) returned 13 [0185.087] IsAppThemed () returned 0x1 [0185.087] GetThemeAppProperties () returned 0x3 [0185.087] GetThemeAppProperties () returned 0x3 [0185.087] IsAppThemed () returned 0x1 [0185.088] GetThemeAppProperties () returned 0x3 [0185.088] GetThemeAppProperties () returned 0x3 [0185.091] IsAppThemed () returned 0x1 [0185.091] GetThemeAppProperties () returned 0x3 [0185.091] GetThemeAppProperties () returned 0x3 [0185.091] IsAppThemed () returned 0x1 [0185.091] GetThemeAppProperties () returned 0x3 [0185.091] GetThemeAppProperties () returned 0x3 [0185.091] IsThemePartDefined () returned 0x1 [0185.091] IsAppThemed () returned 0x1 [0185.091] GetThemeAppProperties () returned 0x3 [0185.091] GetThemeAppProperties () returned 0x3 [0185.091] IsThemeBackgroundPartiallyTransparent () returned 0x1 [0185.092] IsAppThemed () returned 0x1 [0185.092] GetThemeAppProperties () returned 0x3 [0185.092] GetThemeAppProperties () returned 0x3 [0185.093] IsAppThemed () returned 0x1 [0185.093] GetThemeAppProperties () returned 0x3 [0185.093] GetThemeAppProperties () returned 0x3 [0185.093] IsThemePartDefined () returned 0x1 [0185.093] GdipCreateRegion (region=0x19e380) returned 0x0 [0185.093] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0 [0185.093] GdipCreateMatrix (matrix=0x19e380) returned 0x0 [0185.093] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b40a08) returned 0x0 [0185.093] GdipIsMatrixIdentity (matrix=0x5b40a08, result=0x19e398) returned 0x0 [0185.093] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6edf70 [0185.093] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6edf70) returned 0x0 [0185.093] LocalFree (hMem=0x6edf70) returned 0x0 [0185.094] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee0f8 [0185.094] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6ee0f8) returned 0x0 [0185.094] LocalFree (hMem=0x6ee0f8) returned 0x0 [0185.094] GdipDeleteMatrix (matrix=0x5b40a08) returned 0x0 [0185.094] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e3c0) returned 0x0 [0185.094] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e3b0) returned 0x0 [0185.094] GdipGetRegionHRgn (region=0x5b48418, graphics=0x5b3f268, hRgn=0x19e3b0) returned 0x0 [0185.094] GdipDeleteRegion (region=0x5b48418) returned 0x0 [0185.094] GdipGetDC (graphics=0x5b3f268, hdc=0x19e3c8) returned 0x0 [0185.094] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017 [0185.094] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010 [0185.094] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6 [0185.095] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048 [0185.095] SaveDC (hdc=0x810109d5) returned 1 [0185.095] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2104087b [0185.095] GetClipRgn (hdc=0x810109d5, hrgn=0x2104087b) returned 0 [0185.095] SelectClipRgn (hdc=0x810109d5, hrgn=0x610406cc) returned 2 [0185.095] DeleteObject (ho=0x2104087b) returned 1 [0185.095] DeleteObject (ho=0x610406cc) returned 1 [0185.095] OffsetViewportOrgEx (in: hdc=0x810109d5, x=0, y=0, lppt=0x2338468 | out: lppt=0x2338468) returned 1 [0185.095] DrawThemeParentBackground () returned 0x0 [0185.096] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19e0c4 | out: lpwndpl=0x19e0c4) returned 1 [0185.096] GetClientRect (in: hWnd=0xb004c, lpRect=0x19e070 | out: lpRect=0x19e070) returned 1 [0185.096] GetWindowTextLengthW (hWnd=0xb004c) returned 24 [0185.096] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0185.096] GetSystemMetrics (nIndex=42) returned 0 [0185.096] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19df14, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0185.096] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19df14) returned 0x18 [0185.096] GetClientRect (in: hWnd=0xb004c, lpRect=0x19df78 | out: lpRect=0x19df78) returned 1 [0185.096] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017 [0185.096] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010 [0185.096] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6 [0185.096] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048 [0185.096] SaveDC (hdc=0x810109d5) returned 2 [0185.096] GetNearestColor (hdc=0x810109d5, color=0xf0f0f0) returned 0xf0f0f0 [0185.096] CreateSolidBrush (color=0xf0f0f0) returned 0x161008ec [0185.097] FillRect (hDC=0x810109d5, lprc=0x19de18, hbr=0x161008ec) returned 1 [0185.097] DeleteObject (ho=0x161008ec) returned 1 [0185.097] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1 [0185.097] GetWindowTextLengthW (hWnd=0xb004c) returned 24 [0185.097] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0185.097] GetSystemMetrics (nIndex=42) returned 0 [0185.097] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19deb4, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0185.097] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19deb4) returned 0x18 [0185.097] GetClientRect (in: hWnd=0xb004c, lpRect=0x19df18 | out: lpRect=0x19df18) returned 1 [0185.097] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017 [0185.097] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010 [0185.098] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6 [0185.098] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048 [0185.098] SaveDC (hdc=0x810109d5) returned 2 [0185.098] GetNearestColor (hdc=0x810109d5, color=0xf0f0f0) returned 0xf0f0f0 [0185.098] CreateSolidBrush (color=0xf0f0f0) returned 0x171008ec [0185.098] FillRect (hDC=0x810109d5, lprc=0x19ddb8, hbr=0x171008ec) returned 1 [0185.098] DeleteObject (ho=0x171008ec) returned 1 [0185.098] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1 [0185.098] GetWindowTextLengthW (hWnd=0xb004c) returned 24 [0185.098] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0185.098] GetSystemMetrics (nIndex=42) returned 0 [0185.098] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19deb4, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0185.098] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19deb4) returned 0x18 [0185.098] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1 [0185.099] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0 [0185.099] IsAppThemed () returned 0x1 [0185.099] GetThemeAppProperties () returned 0x3 [0185.099] GetThemeAppProperties () returned 0x3 [0185.099] IsAppThemed () returned 0x1 [0185.099] GetThemeAppProperties () returned 0x3 [0185.099] GetThemeAppProperties () returned 0x3 [0185.099] IsThemePartDefined () returned 0x1 [0185.099] GdipCreateRegion (region=0x19e324) returned 0x0 [0185.099] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0 [0185.099] GdipCreateMatrix (matrix=0x19e324) returned 0x0 [0185.099] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b46b80) returned 0x0 [0185.099] GdipIsMatrixIdentity (matrix=0x5b46b80, result=0x19e33c) returned 0x0 [0185.099] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ede58 [0185.099] GdipGetMatrixElements (matrix=0x5b46b80, matrixOut=0x6ede58) returned 0x0 [0185.100] LocalFree (hMem=0x6ede58) returned 0x0 [0185.100] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee440 [0185.100] GdipGetMatrixElements (matrix=0x5b46b80, matrixOut=0x6ee440) returned 0x0 [0185.100] LocalFree (hMem=0x6ee440) returned 0x0 [0185.100] GdipDeleteMatrix (matrix=0x5b46b80) returned 0x0 [0185.100] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e364) returned 0x0 [0185.100] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e354) returned 0x0 [0185.101] GdipGetRegionHRgn (region=0x5b48418, graphics=0x5b3f268, hRgn=0x19e354) returned 0x0 [0185.101] GdipDeleteRegion (region=0x5b48418) returned 0x0 [0185.101] GdipGetDC (graphics=0x5b3f268, hdc=0x19e36c) returned 0x0 [0185.101] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017 [0185.101] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010 [0185.101] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6 [0185.101] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048 [0185.101] SaveDC (hdc=0x810109d5) returned 1 [0185.101] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x620406cc [0185.101] GetClipRgn (hdc=0x810109d5, hrgn=0x620406cc) returned 0 [0185.102] SelectClipRgn (hdc=0x810109d5, hrgn=0x2304087b) returned 2 [0185.102] DeleteObject (ho=0x620406cc) returned 1 [0185.102] DeleteObject (ho=0x2304087b) returned 1 [0185.102] OffsetViewportOrgEx (in: hdc=0x810109d5, x=0, y=0, lppt=0x2338dec | out: lppt=0x2338dec) returned 1 [0185.102] IsAppThemed () returned 0x1 [0185.102] GetThemeAppProperties () returned 0x3 [0185.102] GetThemeAppProperties () returned 0x3 [0185.103] DrawThemeBackground () returned 0x0 [0185.103] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1 [0185.103] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0 [0185.103] GdipCreateRegion (region=0x19e30c) returned 0x0 [0185.104] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0 [0185.104] GdipCreateMatrix (matrix=0x19e30c) returned 0x0 [0185.104] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b40a08) returned 0x0 [0185.104] GdipIsMatrixIdentity (matrix=0x5b40a08, result=0x19e324) returned 0x0 [0185.104] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6edde8 [0185.104] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6edde8) returned 0x0 [0185.106] LocalFree (hMem=0x6edde8) returned 0x0 [0185.106] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ede90 [0185.106] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6ede90) returned 0x0 [0185.107] LocalFree (hMem=0x6ede90) returned 0x0 [0185.107] GdipDeleteMatrix (matrix=0x5b40a08) returned 0x0 [0185.107] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e34c) returned 0x0 [0185.107] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e33c) returned 0x0 [0185.107] GdipGetRegionHRgn (region=0x5b48418, graphics=0x5b3f268, hRgn=0x19e33c) returned 0x0 [0185.107] GdipDeleteRegion (region=0x5b48418) returned 0x0 [0185.107] GdipGetDC (graphics=0x5b3f268, hdc=0x19e354) returned 0x0 [0185.107] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017 [0185.108] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010 [0185.108] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6 [0185.108] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048 [0185.108] SaveDC (hdc=0x810109d5) returned 1 [0185.108] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2404087b [0185.108] GetClipRgn (hdc=0x810109d5, hrgn=0x2404087b) returned 0 [0185.108] SelectClipRgn (hdc=0x810109d5, hrgn=0x630406cc) returned 2 [0185.108] DeleteObject (ho=0x2404087b) returned 1 [0185.108] DeleteObject (ho=0x630406cc) returned 1 [0185.108] OffsetViewportOrgEx (in: hdc=0x810109d5, x=0, y=0, lppt=0x23390c0 | out: lppt=0x23390c0) returned 1 [0185.108] IsAppThemed () returned 0x1 [0185.108] GetThemeAppProperties () returned 0x3 [0185.108] GetThemeAppProperties () returned 0x3 [0185.109] GetThemeBackgroundContentRect () returned 0x0 [0185.109] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1 [0185.109] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0 [0185.110] IsAppThemed () returned 0x1 [0185.110] GetThemeAppProperties () returned 0x3 [0185.110] GetThemeAppProperties () returned 0x3 [0185.110] GdipGetTextRenderingHint (graphics=0x5b3f268, mode=0x19e484) returned 0x0 [0185.110] GdipGetDC (graphics=0x5b3f268, hdc=0x19e470) returned 0x0 [0185.110] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017 [0185.110] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010 [0185.110] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6 [0185.110] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048 [0185.111] SaveDC (hdc=0x810109d5) returned 1 [0185.111] GetTextAlign (hdc=0x810109d5) returned 0x0 [0185.111] GetTextColor (hdc=0x810109d5) returned 0x0 [0185.111] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048 [0185.111] GetObjectW (in: h=0x18a0048, c=92, pv=0x19e178 | out: pv=0x19e178) returned 92 [0185.111] SelectObject (hdc=0x810109d5, h=0x7e0a09e9) returned 0x18a0048 [0185.111] GetBkMode (hdc=0x810109d5) returned 2 [0185.111] SetBkMode (hdc=0x810109d5, mode=1) returned 2 [0185.111] DrawTextExW (in: hdc=0x810109d5, lpchText="&Continue", cchText=9, lprc=0x19e24c, format=0x102415, lpdtp=0x2339460 | out: lpchText="&Continue", lprc=0x19e24c) returned 13 [0185.112] DrawTextExW (in: hdc=0x810109d5, lpchText="&Continue", cchText=9, lprc=0x19e404, format=0x102015, lpdtp=0x2339460 | out: lpchText="&Continue", lprc=0x19e404) returned 13 [0185.112] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1 [0185.112] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0 [0185.112] GetFocus () returned 0x5028a [0185.112] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x19e53c, fWinIni=0x0 | out: pvParam=0x19e53c) returned 1 [0185.112] SendMessageW (hWnd=0xb004c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0185.112] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0 [0185.112] IsAppThemed () returned 0x1 [0185.113] GetThemeAppProperties () returned 0x3 [0185.113] GetThemeAppProperties () returned 0x3 [0185.113] GdipGetDC (graphics=0x5b3f268, hdc=0x19e65c) returned 0x0 [0185.113] BitBlt (hdc=0x110106ca, x=0, y=0, cx=100, cy=23, hdcSrc=0x810109d5, x1=0, y1=0, rop=0xcc0020) returned 1 [0185.113] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0 [0185.113] SelectPalette (hdc=0x110106ca, hPal=0x188000b, bForceBkgd=0) returned 0x6e0806d0 [0185.113] SelectObject (hdc=0x810109d5, h=0x185000f) returned 0x3f0506d6 [0185.113] DeleteDC (hdc=0x810109d5) returned 1 [0185.113] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0 [0185.113] EndPaint (hWnd=0x5028a, lpPaint=0x19e600) returned 1 [0185.114] MapWindowPoints (in: hWndFrom=0x5028a, hWndTo=0x0, lpPoints=0x233955c, cPoints=0x1 | out: lpPoints=0x233955c) returned 30999254 [0185.114] WindowFromPoint (Point=0x2f0) returned 0x5028a [0185.114] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1 [0185.114] NotifyWinEvent (event=0x800a, hwnd=0x5028a, idObject=-4, idChild=0) [0185.114] NotifyWinEvent (event=0x800c, hwnd=0x5028a, idObject=-4, idChild=0) [0185.114] GetCapture () returned 0x5028a [0185.114] ReleaseCapture () returned 1 [0185.115] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0 [0185.115] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1 [0185.115] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1 [0185.143] IsWindow (hWnd=0x802a2) returned 1 [0185.144] EnableWindow (hWnd=0x802a2, bEnable=1) returned 1 [0185.144] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0 [0185.144] GetWindowLongW (hWnd=0xb004c, nIndex=-8) returned 0 [0185.144] IsWindow (hWnd=0x0) returned 0 [0185.144] IsWindow (hWnd=0x0) returned 0 [0185.144] IsWindow (hWnd=0x0) returned 0 [0185.144] GetFocus () returned 0x5028a [0185.145] IsChild (hWndParent=0xb004c, hWnd=0x5028a) returned 1 [0185.145] ShowWindow (hWnd=0xb004c, nCmdShow=0) returned 1 [0185.145] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0185.145] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19ee2c) returned 0x0 [0185.148] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19eb9c | out: lpwndpl=0x19eb9c) returned 1 [0185.148] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x47, wParam=0x0, lParam=0x19ee2c) returned 0x0 [0185.148] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eb4c | out: lpRect=0x19eb4c) returned 1 [0185.148] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eb4c | out: lpRect=0x19eb4c) returned 1 [0185.149] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0185.150] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0185.150] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0185.167] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0185.168] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0185.171] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0185.171] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0185.173] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x1c, wParam=0x0, lParam=0x1150) returned 0x0 [0185.173] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x1c, wParam=0x0, lParam=0x1150) returned 0x0 [0185.173] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x1c, wParam=0x0, lParam=0x1150) returned 0x0 [0185.173] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x1c, wParam=0x0, lParam=0x1150) returned 0x0 [0185.173] GetFocus () returned 0x0 [0185.173] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0185.173] GetCapture () returned 0x0 [0185.173] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1 [0185.174] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0185.174] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0185.174] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0185.178] GetWindowLongW (hWnd=0xb004c, nIndex=-20) returned 327945 [0185.178] DestroyWindow (hWnd=0xb004c) returned 1 [0185.178] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0185.227] GetWindowTextLengthW (hWnd=0xb004c) returned 24 [0185.227] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18 [0185.227] GetSystemMetrics (nIndex=42) returned 0 [0185.227] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19ea5c, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24 [0185.227] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19ea5c) returned 0x18 [0185.227] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0185.230] GetWindowTextLengthW (hWnd=0x3031c) returned 0 [0185.230] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0185.230] GetSystemMetrics (nIndex=42) returned 0 [0185.230] GetWindowTextW (in: hWnd=0x3031c, lpString=0x19ea90, nMaxCount=1 | out: lpString="") returned 0 [0185.230] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xd, wParam=0x1, lParam=0x19ea90) returned 0x0 [0185.230] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0185.231] GetWindowThreadProcessId (in: hWnd=0x601fe, lpdwProcessId=0x19eb20 | out: lpdwProcessId=0x19eb20) returned 0xbf8 [0185.231] GetWindow (hWnd=0x601fe, uCmd=0x5) returned 0x0 [0185.231] GetWindowLongW (hWnd=0x601fe, nIndex=-20) returned 65792 [0185.231] DestroyWindow (hWnd=0x601fe) returned 1 [0185.231] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0185.231] GetWindowTextLengthW (hWnd=0x601fe) returned 25 [0185.231] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x19 [0185.231] GetSystemMetrics (nIndex=42) returned 0 [0185.231] GetWindowTextW (in: hWnd=0x601fe, lpString=0x19e62c, nMaxCount=26 | out: lpString="WindowsFormsParkingWindow") returned 25 [0185.231] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0xd, wParam=0x1a, lParam=0x19e62c) returned 0x19 [0185.231] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0185.243] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0185.256] GetWindowTextLengthW (hWnd=0x801f0) returned 242 [0185.256] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xf2 [0185.256] GetSystemMetrics (nIndex=42) returned 0 [0185.256] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19e898, nMaxCount=243 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.") returned 242 [0185.256] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0xf3, lParam=0x19e898) returned 0xf2 [0185.256] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0185.256] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0185.257] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1 [0185.257] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0185.257] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0185.257] SendMessageW (hWnd=0x60248, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0185.257] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0 [0185.257] SendMessageW (hWnd=0x60248, Msg=0xb0, wParam=0x230b138, lParam=0x19eb4c) returned 0x0 [0185.257] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xb0, wParam=0x230b138, lParam=0x19eb4c) returned 0x0 [0185.258] GetWindowTextLengthW (hWnd=0x60248) returned 4562 [0185.258] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11d2 [0185.258] GetSystemMetrics (nIndex=42) returned 0 [0185.258] CoTaskMemAlloc (cb=0x23aa) returned 0x70be70 [0185.258] GetWindowTextW (in: hWnd=0x60248, lpString=0x70be70, nMaxCount=4563 | out: lpString="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 192.30.89.67:11344\r\n at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)\r\n at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)\r\n --- End of inner exception stack trace ---\r\n at System.Net.WebClient.UploadValues(Uri address, String method, NameValueCollection data)\r\n at System.Net.WebClient.UploadValues(String address, String method, NameValueCollection data)\r\n at eda2.Form1.GetPublicKey(String url)\r\n at eda2.Form1.StartAction()\r\n at eda2.Form1.Form1_Load(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Form.OnCreateControl()\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.ScrollableControl.WndProc(Message& m)\r\n at System.Windows.Forms.Form.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Form.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll\r\n----------------------------------------\r\nnotepad\r\n Assembly Version: 2.1.0.0\r\n Win32 Version: 2.1.0.0\r\n CodeBase: file:///C:/Users/RDHJ0C~1/AppData/Local/Temp/svhost.exe\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Core\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll\r\n----------------------------------------\r\nSystem.Configuration\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll\r\n----------------------------------------\r\nSystem.Xml\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n") returned 4562 [0185.258] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xd, wParam=0x11d3, lParam=0x70be70) returned 0x11d2 [0185.258] CoTaskMemFree (pv=0x70be70) [0185.259] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x1 [0185.260] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0185.262] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0185.264] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0185.271] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0185.274] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0185.276] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0185.279] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0185.292] GetWindowTextLengthW (hWnd=0x802a2) returned 7 [0185.292] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0185.292] GetSystemMetrics (nIndex=42) returned 0 [0185.292] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19f210, nMaxCount=8 | out: lpString="notepad") returned 7 [0185.292] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19f210) returned 0x7 [0185.293] PeekMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f410) returned 1 [0185.293] IsWindowUnicode (hWnd=0x802a2) returned 1 [0185.293] GetMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f410) returned 1 [0185.293] TranslateMessage (lpMsg=0x19f410) returned 0 [0185.293] DispatchMessageW (lpMsg=0x19f410) returned 0x0 [0185.293] BeginPaint (in: hWnd=0x802a2, lpPaint=0x19eed4 | out: lpPaint=0x19eed4) returned 0x50107d3 [0185.293] SelectPalette (hdc=0x50107d3, hPal=0x6e0806d0, bForceBkgd=1) returned 0x188000b [0185.294] GetWindowTextLengthW (hWnd=0x802a2) returned 7 [0185.294] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7 [0185.294] GetSystemMetrics (nIndex=42) returned 0 [0185.294] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19ee6c, nMaxCount=8 | out: lpString="notepad") returned 7 [0185.294] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19ee6c) returned 0x7 [0185.294] SelectPalette (hdc=0x50107d3, hPal=0x188000b, bForceBkgd=0) returned 0x6e0806d0 [0185.294] EndPaint (hWnd=0x802a2, lpPaint=0x19eed0) returned 1 [0185.294] PeekMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f410) returned 0 [0185.295] PeekMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f410) returned 0 [0185.295] WaitMessage () Thread: id = 6 os_tid = 0x1c4 Thread: id = 7 os_tid = 0xd34 Thread: id = 8 os_tid = 0x590 [0131.640] CoGetContextToken (in: pToken=0x42bfc3c | out: pToken=0x42bfc3c) returned 0x800401f0 [0131.640] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0131.640] RoInitialize () returned 0x1 [0131.640] RoUninitialize () returned 0x0 Thread: id = 9 os_tid = 0xa08 Thread: id = 13 os_tid = 0xde0 Thread: id = 14 os_tid = 0x1390 Thread: id = 15 os_tid = 0xcc4 Thread: id = 16 os_tid = 0x3a0 Thread: id = 17 os_tid = 0x2e8 [0160.363] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0160.363] RoInitialize () returned 0x1 [0160.363] RoUninitialize () returned 0x0 [0160.366] ResetEvent (hEvent=0x36c) returned 1 [0290.365] CoUninitialize ()