# Flog Txt Version 1
# Analyzer Version: 4.4.1
# Analyzer Build Date: Jan 14 2022 06:06:11
# Log Creation Date: 25.04.2022 12:27:06.459
Process:
id = "1"
image_name = "baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe"
filename = "c:\\users\\rdhj0cnfevzx\\desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe"
page_root = "0x6a8ad000"
os_pid = "0x464"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "analysis_target"
parent_id = "0"
os_parent_pid = "0x4a0"
cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe\" "
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 124
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 125
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 126
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 127
start_va = 0x60000
end_va = 0x9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 128
start_va = 0xa0000
end_va = 0x19ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 129
start_va = 0x1a0000
end_va = 0x1a3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001a0000"
filename = ""
Region:
id = 130
start_va = 0x1b0000
end_va = 0x1b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001b0000"
filename = ""
Region:
id = 131
start_va = 0x1c0000
end_va = 0x1c1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 132
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 133
start_va = 0x400000
end_va = 0x43ffff
monitored = 1
entry_point = 0x4330bb
region_type = mapped_file
name = "baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe")
Region:
id = 134
start_va = 0x77720000
end_va = 0x7789afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 135
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 136
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 137
start_va = 0x7fff0000
end_va = 0x7ff87ff9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 138
start_va = 0x7ff87ffa0000
end_va = 0x7ff880160fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 139
start_va = 0x7ff880161000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ff880161000"
filename = ""
Region:
id = 277
start_va = 0x560000
end_va = 0x56ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000560000"
filename = ""
Region:
id = 278
start_va = 0x662d0000
end_va = 0x66349fff
monitored = 0
entry_point = 0x662e3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 279
start_va = 0x66350000
end_va = 0x6639ffff
monitored = 0
entry_point = 0x66368180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 280
start_va = 0x75600000
end_va = 0x756dffff
monitored = 0
entry_point = 0x75613980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 281
start_va = 0x663a0000
end_va = 0x663a7fff
monitored = 0
entry_point = 0x663a17c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 282
start_va = 0x570000
end_va = 0x85ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000570000"
filename = ""
Region:
id = 283
start_va = 0x6cec0000
end_va = 0x6cf18fff
monitored = 1
entry_point = 0x6ced0780
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")
Region:
id = 284
start_va = 0x75600000
end_va = 0x756dffff
monitored = 0
entry_point = 0x75613980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 285
start_va = 0x75480000
end_va = 0x755fdfff
monitored = 0
entry_point = 0x75531b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 286
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 287
start_va = 0x7feb0000
end_va = 0x7ffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007feb0000"
filename = ""
Region:
id = 288
start_va = 0x440000
end_va = 0x4fdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 289
start_va = 0x500000
end_va = 0x55ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 290
start_va = 0x743a0000
end_va = 0x74431fff
monitored = 0
entry_point = 0x743e0380
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")
Region:
id = 291
start_va = 0x7fb00000
end_va = 0x7fea0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 292
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 293
start_va = 0x74650000
end_va = 0x746cafff
monitored = 0
entry_point = 0x7466e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 294
start_va = 0x748c0000
end_va = 0x7497dfff
monitored = 0
entry_point = 0x748f5630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 295
start_va = 0x500000
end_va = 0x53ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 296
start_va = 0x550000
end_va = 0x55ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000550000"
filename = ""
Region:
id = 297
start_va = 0x570000
end_va = 0x66ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000570000"
filename = ""
Region:
id = 298
start_va = 0x760000
end_va = 0x85ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000760000"
filename = ""
Region:
id = 299
start_va = 0x76ae0000
end_va = 0x76b23fff
monitored = 0
entry_point = 0x76af9d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 300
start_va = 0x75260000
end_va = 0x7530cfff
monitored = 0
entry_point = 0x75274f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 301
start_va = 0x74450000
end_va = 0x7446dfff
monitored = 0
entry_point = 0x7445b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 302
start_va = 0x74440000
end_va = 0x74449fff
monitored = 0
entry_point = 0x74442a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 303
start_va = 0x74590000
end_va = 0x745e7fff
monitored = 0
entry_point = 0x745d25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 304
start_va = 0x860000
end_va = 0xa2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000860000"
filename = ""
Region:
id = 305
start_va = 0x6ce40000
end_va = 0x6ceb8fff
monitored = 1
entry_point = 0x6ce4f82a
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")
Region:
id = 306
start_va = 0x77240000
end_va = 0x77284fff
monitored = 0
entry_point = 0x7725de90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 307
start_va = 0x77290000
end_va = 0x7744cfff
monitored = 0
entry_point = 0x77372a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 308
start_va = 0x76b30000
end_va = 0x76c7efff
monitored = 0
entry_point = 0x76be6820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 309
start_va = 0x77450000
end_va = 0x77596fff
monitored = 0
entry_point = 0x77461cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 310
start_va = 0x1d0000
end_va = 0x1f9fff
monitored = 0
entry_point = 0x1d5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 311
start_va = 0x860000
end_va = 0x9e7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000860000"
filename = ""
Region:
id = 312
start_va = 0xa20000
end_va = 0xa2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a20000"
filename = ""
Region:
id = 313
start_va = 0x74ea0000
end_va = 0x74ecafff
monitored = 0
entry_point = 0x74ea5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 314
start_va = 0x30000
end_va = 0x30fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 315
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 316
start_va = 0x670000
end_va = 0x6a9fff
monitored = 1
entry_point = 0x6a30bb
region_type = mapped_file
name = "baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe")
Region:
id = 317
start_va = 0xa30000
end_va = 0xbb0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a30000"
filename = ""
Region:
id = 318
start_va = 0xbc0000
end_va = 0x1fbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000bc0000"
filename = ""
Region:
id = 319
start_va = 0x76e20000
end_va = 0x76e2bfff
monitored = 0
entry_point = 0x76e23930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 320
start_va = 0x6ce30000
end_va = 0x6ce37fff
monitored = 0
entry_point = 0x6ce317b0
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")
Region:
id = 321
start_va = 0x6c400000
end_va = 0x6cab0fff
monitored = 1
entry_point = 0x6c415d20
region_type = mapped_file
name = "clr.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")
Region:
id = 322
start_va = 0x6cd30000
end_va = 0x6ce24fff
monitored = 0
entry_point = 0x6cd84160
region_type = mapped_file
name = "msvcr120_clr0400.dll"
filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll")
Region:
id = 323
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 324
start_va = 0x1f0000
end_va = 0x1fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 325
start_va = 0x540000
end_va = 0x54ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000540000"
filename = ""
Region:
id = 326
start_va = 0x670000
end_va = 0x67ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000670000"
filename = ""
Region:
id = 327
start_va = 0x680000
end_va = 0x68ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000680000"
filename = ""
Region:
id = 328
start_va = 0x690000
end_va = 0x69ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000690000"
filename = ""
Region:
id = 329
start_va = 0x6a0000
end_va = 0x6affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006a0000"
filename = ""
Region:
id = 330
start_va = 0x6b0000
end_va = 0x6b0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006b0000"
filename = ""
Region:
id = 331
start_va = 0x6c0000
end_va = 0x6c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006c0000"
filename = ""
Region:
id = 332
start_va = 0x1fc0000
end_va = 0x210ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001fc0000"
filename = ""
Region:
id = 333
start_va = 0x2110000
end_va = 0x22dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002110000"
filename = ""
Region:
id = 334
start_va = 0x6d0000
end_va = 0x70ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006d0000"
filename = ""
Region:
id = 335
start_va = 0x1fc0000
end_va = 0x20bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001fc0000"
filename = ""
Region:
id = 336
start_va = 0x2100000
end_va = 0x210ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002100000"
filename = ""
Region:
id = 337
start_va = 0x710000
end_va = 0x71ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000710000"
filename = ""
Region:
id = 338
start_va = 0x22e0000
end_va = 0x42dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000022e0000"
filename = ""
Region:
id = 339
start_va = 0x2110000
end_va = 0x21affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002110000"
filename = ""
Region:
id = 340
start_va = 0x22d0000
end_va = 0x22dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000022d0000"
filename = ""
Region:
id = 341
start_va = 0x710000
end_va = 0x74ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000710000"
filename = ""
Region:
id = 342
start_va = 0x21b0000
end_va = 0x22affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000021b0000"
filename = ""
Region:
id = 343
start_va = 0x42e0000
end_va = 0x4616fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 344
start_va = 0x6b1d0000
end_va = 0x6c3f7fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "mscorlib.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll")
Region:
id = 345
start_va = 0x74720000
end_va = 0x7480afff
monitored = 0
entry_point = 0x7475d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 346
start_va = 0x4620000
end_va = 0x46b0fff
monitored = 0
entry_point = 0x4658cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 347
start_va = 0x706b0000
end_va = 0x70724fff
monitored = 0
entry_point = 0x706e9a60
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 348
start_va = 0x4620000
end_va = 0x480ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004620000"
filename = ""
Region:
id = 349
start_va = 0x6d720000
end_va = 0x6d732fff
monitored = 0
entry_point = 0x6d729950
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 350
start_va = 0x6ffd0000
end_va = 0x6fffefff
monitored = 0
entry_point = 0x6ffe95e0
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 351
start_va = 0x740f0000
end_va = 0x7410afff
monitored = 0
entry_point = 0x740f9050
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 352
start_va = 0x750000
end_va = 0x75ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000750000"
filename = ""
Region:
id = 353
start_va = 0x6b150000
end_va = 0x6b1cdfff
monitored = 1
entry_point = 0x6b151140
region_type = mapped_file
name = "clrjit.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")
Region:
id = 354
start_va = 0x753c0000
end_va = 0x75451fff
monitored = 0
entry_point = 0x753f8cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 355
start_va = 0x9f0000
end_va = 0x9fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000009f0000"
filename = ""
Region:
id = 356
start_va = 0xa00000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a00000"
filename = ""
Region:
id = 357
start_va = 0xa10000
end_va = 0xa1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a10000"
filename = ""
Region:
id = 358
start_va = 0x4620000
end_va = 0x47affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004620000"
filename = ""
Region:
id = 359
start_va = 0x4800000
end_va = 0x480ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004800000"
filename = ""
Region:
id = 360
start_va = 0xa00000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a00000"
filename = ""
Region:
id = 361
start_va = 0x5e430000
end_va = 0x5e4cbfff
monitored = 1
entry_point = 0x5e4be9b2
region_type = mapped_file
name = "microsoft.visualbasic.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll")
Region:
id = 362
start_va = 0x4620000
end_va = 0x46bbfff
monitored = 1
entry_point = 0x46ae9b2
region_type = mapped_file
name = "microsoft.visualbasic.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll")
Region:
id = 363
start_va = 0x47a0000
end_va = 0x47affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047a0000"
filename = ""
Region:
id = 364
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 365
start_va = 0xa00000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a00000"
filename = ""
Region:
id = 366
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 367
start_va = 0xa00000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a00000"
filename = ""
Region:
id = 368
start_va = 0xa00000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a00000"
filename = ""
Region:
id = 369
start_va = 0xa00000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a00000"
filename = ""
Region:
id = 370
start_va = 0xa00000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a00000"
filename = ""
Region:
id = 371
start_va = 0xa00000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a00000"
filename = ""
Region:
id = 372
start_va = 0xa00000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a00000"
filename = ""
Region:
id = 373
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 374
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 375
start_va = 0x6a7a0000
end_va = 0x6b14bfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll")
Region:
id = 376
start_va = 0x6a080000
end_va = 0x6a791fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.core.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll")
Region:
id = 377
start_va = 0x20d0000
end_va = 0x20dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020d0000"
filename = ""
Region:
id = 378
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 379
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 380
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 381
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 382
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 383
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 384
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 385
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 386
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 387
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 388
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 389
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 390
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 391
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 392
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 393
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 394
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 395
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 396
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 397
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 398
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 399
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 400
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 401
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 402
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 403
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 404
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 405
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 406
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 407
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 408
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 409
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 410
start_va = 0x20f0000
end_va = 0x20fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020f0000"
filename = ""
Region:
id = 411
start_va = 0x22b0000
end_va = 0x22bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000022b0000"
filename = ""
Region:
id = 412
start_va = 0x22c0000
end_va = 0x22cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000022c0000"
filename = ""
Region:
id = 413
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 414
start_va = 0x4810000
end_va = 0x490ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004810000"
filename = ""
Region:
id = 415
start_va = 0x46c0000
end_va = 0x4721fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "mscorrc.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll")
Region:
id = 416
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 417
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 418
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 419
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 420
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 421
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 422
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 423
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 424
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 425
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 426
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 427
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 428
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 429
start_va = 0x4730000
end_va = 0x4767fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004730000"
filename = ""
Region:
id = 430
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 431
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 432
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 433
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 434
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 435
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 436
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 437
start_va = 0x22b0000
end_va = 0x22c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000022b0000"
filename = ""
Region:
id = 438
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 439
start_va = 0x20c0000
end_va = 0x20cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 440
start_va = 0x20c0000
end_va = 0x20c1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000020c0000"
filename = ""
Region:
id = 441
start_va = 0x20f0000
end_va = 0x20f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000020f0000"
filename = ""
Region:
id = 442
start_va = 0x4910000
end_va = 0x49effff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")
Region:
id = 443
start_va = 0x6cd00000
end_va = 0x6cd27fff
monitored = 0
entry_point = 0x6cd07820
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")
Region:
id = 444
start_va = 0x6a000000
end_va = 0x6a070fff
monitored = 0
entry_point = 0x6a0569e0
region_type = mapped_file
name = "efswrt.dll"
filename = "\\Windows\\SysWOW64\\efswrt.dll" (normalized: "c:\\windows\\syswow64\\efswrt.dll")
Region:
id = 445
start_va = 0x751c0000
end_va = 0x7524cfff
monitored = 0
entry_point = 0x75209b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 446
start_va = 0x74020000
end_va = 0x740e7fff
monitored = 0
entry_point = 0x7408ae90
region_type = mapped_file
name = "wintypes.dll"
filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll")
Region:
id = 447
start_va = 0x69fb0000
end_va = 0x69ff8fff
monitored = 0
entry_point = 0x69fb6450
region_type = mapped_file
name = "edputil.dll"
filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll")
Region:
id = 448
start_va = 0x4770000
end_va = 0x477ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004770000"
filename = ""
Region:
id = 449
start_va = 0x4780000
end_va = 0x478ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004780000"
filename = ""
Region:
id = 450
start_va = 0x47b0000
end_va = 0x47cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047b0000"
filename = ""
Region:
id = 451
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 452
start_va = 0x47d0000
end_va = 0x47dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047d0000"
filename = ""
Region:
id = 453
start_va = 0x47e0000
end_va = 0x47effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047e0000"
filename = ""
Region:
id = 454
start_va = 0x47f0000
end_va = 0x47fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047f0000"
filename = ""
Region:
id = 455
start_va = 0x49f0000
end_va = 0x49fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000049f0000"
filename = ""
Region:
id = 456
start_va = 0x4a00000
end_va = 0x4a0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a00000"
filename = ""
Region:
id = 457
start_va = 0x4a10000
end_va = 0x4a1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a10000"
filename = ""
Region:
id = 458
start_va = 0x4a20000
end_va = 0x4a2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a20000"
filename = ""
Region:
id = 459
start_va = 0x4a30000
end_va = 0x4a3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a30000"
filename = ""
Region:
id = 460
start_va = 0x4a40000
end_va = 0x4a4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a40000"
filename = ""
Region:
id = 461
start_va = 0x4a50000
end_va = 0x4a5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a50000"
filename = ""
Region:
id = 462
start_va = 0x4a60000
end_va = 0x4a6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a60000"
filename = ""
Region:
id = 463
start_va = 0x4a70000
end_va = 0x4a7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a70000"
filename = ""
Region:
id = 464
start_va = 0x4a80000
end_va = 0x4a8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a80000"
filename = ""
Region:
id = 465
start_va = 0x4a90000
end_va = 0x4a9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a90000"
filename = ""
Region:
id = 466
start_va = 0x4aa0000
end_va = 0x4aaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004aa0000"
filename = ""
Region:
id = 467
start_va = 0x4ab0000
end_va = 0x4abffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ab0000"
filename = ""
Region:
id = 468
start_va = 0x4ac0000
end_va = 0x4acffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ac0000"
filename = ""
Region:
id = 469
start_va = 0x4ad0000
end_va = 0x4adffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ad0000"
filename = ""
Region:
id = 470
start_va = 0x4ae0000
end_va = 0x4aeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ae0000"
filename = ""
Region:
id = 471
start_va = 0x4af0000
end_va = 0x4afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004af0000"
filename = ""
Region:
id = 472
start_va = 0x4b00000
end_va = 0x4b0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b00000"
filename = ""
Region:
id = 473
start_va = 0x4b10000
end_va = 0x4b1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b10000"
filename = ""
Region:
id = 474
start_va = 0x4b20000
end_va = 0x4b2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b20000"
filename = ""
Region:
id = 475
start_va = 0x4b30000
end_va = 0x4b3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b30000"
filename = ""
Region:
id = 476
start_va = 0x4b40000
end_va = 0x4b4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b40000"
filename = ""
Region:
id = 477
start_va = 0x4b50000
end_va = 0x4b5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b50000"
filename = ""
Region:
id = 478
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 479
start_va = 0x4b70000
end_va = 0x4b7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b70000"
filename = ""
Region:
id = 480
start_va = 0x4b80000
end_va = 0x4b8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b80000"
filename = ""
Region:
id = 481
start_va = 0x4b90000
end_va = 0x4b9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b90000"
filename = ""
Region:
id = 482
start_va = 0x4ba0000
end_va = 0x4baffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ba0000"
filename = ""
Region:
id = 483
start_va = 0x4bb0000
end_va = 0x4bbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004bb0000"
filename = ""
Region:
id = 484
start_va = 0x4bc0000
end_va = 0x4bcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004bc0000"
filename = ""
Region:
id = 485
start_va = 0x4bd0000
end_va = 0x4bdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004bd0000"
filename = ""
Region:
id = 486
start_va = 0x4be0000
end_va = 0x4beffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004be0000"
filename = ""
Region:
id = 487
start_va = 0x4bf0000
end_va = 0x4bfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004bf0000"
filename = ""
Region:
id = 488
start_va = 0x4c00000
end_va = 0x4c0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c00000"
filename = ""
Region:
id = 489
start_va = 0x4c10000
end_va = 0x4c1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c10000"
filename = ""
Region:
id = 490
start_va = 0x4c20000
end_va = 0x4c2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c20000"
filename = ""
Region:
id = 491
start_va = 0x4c30000
end_va = 0x4c3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c30000"
filename = ""
Region:
id = 492
start_va = 0x4c40000
end_va = 0x4c4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c40000"
filename = ""
Region:
id = 493
start_va = 0x4c50000
end_va = 0x4c5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c50000"
filename = ""
Region:
id = 494
start_va = 0x4c60000
end_va = 0x4c6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c60000"
filename = ""
Region:
id = 495
start_va = 0x4c70000
end_va = 0x4c7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c70000"
filename = ""
Region:
id = 496
start_va = 0x4c80000
end_va = 0x4c8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c80000"
filename = ""
Region:
id = 497
start_va = 0x4c90000
end_va = 0x4c9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c90000"
filename = ""
Region:
id = 498
start_va = 0x4ca0000
end_va = 0x4caffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ca0000"
filename = ""
Region:
id = 499
start_va = 0x4cb0000
end_va = 0x4cbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cb0000"
filename = ""
Region:
id = 500
start_va = 0x4cc0000
end_va = 0x4ccffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cc0000"
filename = ""
Region:
id = 501
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 502
start_va = 0x4ce0000
end_va = 0x4ceffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ce0000"
filename = ""
Region:
id = 503
start_va = 0x4cf0000
end_va = 0x4cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cf0000"
filename = ""
Region:
id = 504
start_va = 0x4d00000
end_va = 0x4d0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d00000"
filename = ""
Region:
id = 505
start_va = 0x4d10000
end_va = 0x4d1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d10000"
filename = ""
Region:
id = 506
start_va = 0x4d20000
end_va = 0x4d2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d20000"
filename = ""
Region:
id = 507
start_va = 0x4d30000
end_va = 0x4d3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d30000"
filename = ""
Region:
id = 508
start_va = 0x4d40000
end_va = 0x4d4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d40000"
filename = ""
Region:
id = 509
start_va = 0x4d50000
end_va = 0x4d6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d50000"
filename = ""
Region:
id = 510
start_va = 0x4d70000
end_va = 0x4d7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d70000"
filename = ""
Region:
id = 511
start_va = 0x4d80000
end_va = 0x4d8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d80000"
filename = ""
Region:
id = 512
start_va = 0x4d90000
end_va = 0x4d9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d90000"
filename = ""
Region:
id = 513
start_va = 0x4da0000
end_va = 0x4daffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004da0000"
filename = ""
Region:
id = 514
start_va = 0x4db0000
end_va = 0x4dbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004db0000"
filename = ""
Region:
id = 515
start_va = 0x4dc0000
end_va = 0x4dcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004dc0000"
filename = ""
Region:
id = 516
start_va = 0x4dd0000
end_va = 0x4ddffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004dd0000"
filename = ""
Region:
id = 517
start_va = 0x4de0000
end_va = 0x4deffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004de0000"
filename = ""
Region:
id = 518
start_va = 0x4df0000
end_va = 0x4dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004df0000"
filename = ""
Region:
id = 519
start_va = 0x4e00000
end_va = 0x4e2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e00000"
filename = ""
Region:
id = 520
start_va = 0x4e30000
end_va = 0x4e3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e30000"
filename = ""
Region:
id = 521
start_va = 0x4e40000
end_va = 0x4e4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e40000"
filename = ""
Region:
id = 522
start_va = 0x4e50000
end_va = 0x4e5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e50000"
filename = ""
Region:
id = 523
start_va = 0x4e60000
end_va = 0x4e6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e60000"
filename = ""
Region:
id = 524
start_va = 0x4e70000
end_va = 0x4e7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e70000"
filename = ""
Region:
id = 525
start_va = 0x4e80000
end_va = 0x4e8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e80000"
filename = ""
Region:
id = 526
start_va = 0x4e90000
end_va = 0x4e9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e90000"
filename = ""
Region:
id = 527
start_va = 0x4ea0000
end_va = 0x4eaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ea0000"
filename = ""
Region:
id = 528
start_va = 0x4eb0000
end_va = 0x4ebffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004eb0000"
filename = ""
Region:
id = 529
start_va = 0x4ec0000
end_va = 0x4ecffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ec0000"
filename = ""
Region:
id = 530
start_va = 0x4ed0000
end_va = 0x4edffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ed0000"
filename = ""
Region:
id = 531
start_va = 0x4ee0000
end_va = 0x4eeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ee0000"
filename = ""
Region:
id = 532
start_va = 0x4ef0000
end_va = 0x4efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ef0000"
filename = ""
Region:
id = 533
start_va = 0x4f00000
end_va = 0x4f0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f00000"
filename = ""
Region:
id = 534
start_va = 0x4f10000
end_va = 0x4f1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f10000"
filename = ""
Region:
id = 535
start_va = 0x4f20000
end_va = 0x4f2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f20000"
filename = ""
Region:
id = 536
start_va = 0x4f30000
end_va = 0x4f3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f30000"
filename = ""
Region:
id = 537
start_va = 0x4f40000
end_va = 0x4f4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f40000"
filename = ""
Region:
id = 538
start_va = 0x4f50000
end_va = 0x4f5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f50000"
filename = ""
Region:
id = 539
start_va = 0x4f60000
end_va = 0x4f6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f60000"
filename = ""
Region:
id = 540
start_va = 0x4f70000
end_va = 0x4f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f70000"
filename = ""
Region:
id = 541
start_va = 0x4f80000
end_va = 0x4faffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f80000"
filename = ""
Region:
id = 542
start_va = 0x4fb0000
end_va = 0x4fbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004fb0000"
filename = ""
Region:
id = 543
start_va = 0x4fc0000
end_va = 0x4fcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004fc0000"
filename = ""
Region:
id = 544
start_va = 0x4770000
end_va = 0x477ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004770000"
filename = ""
Region:
id = 545
start_va = 0x4770000
end_va = 0x477ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004770000"
filename = ""
Region:
id = 546
start_va = 0x7fb00000
end_va = 0x7fea0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 694
start_va = 0x47b0000
end_va = 0x47effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047b0000"
filename = ""
Region:
id = 695
start_va = 0x49f0000
end_va = 0x4aeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000049f0000"
filename = ""
Region:
id = 696
start_va = 0x4af0000
end_va = 0x4b2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004af0000"
filename = ""
Region:
id = 697
start_va = 0x4b30000
end_va = 0x4c2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b30000"
filename = ""
Region:
id = 700
start_va = 0x4770000
end_va = 0x477ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004770000"
filename = ""
Region:
id = 701
start_va = 0x4770000
end_va = 0x477ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004770000"
filename = ""
Region:
id = 702
start_va = 0x4770000
end_va = 0x477ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004770000"
filename = ""
Region:
id = 703
start_va = 0x4770000
end_va = 0x477ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004770000"
filename = ""
Region:
id = 704
start_va = 0x4770000
end_va = 0x477ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004770000"
filename = ""
Region:
id = 707
start_va = 0x4c30000
end_va = 0x4c6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c30000"
filename = ""
Region:
id = 708
start_va = 0x4c70000
end_va = 0x4d6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004c70000"
filename = ""
Thread:
id = 1
os_tid = 0xc60
[0112.507] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
[0113.468] RoInitialize () returned 0x1
[0113.468] RoUninitialize () returned 0x0
[0119.264] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe", nBufferLength=0x105, lpBuffer=0x19edcc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe", lpFilePart=0x0) returned 0x62
[0119.441] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19f308 | out: pfEnabled=0x19f308) returned 0x0
[0119.574] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x19f1d8, nSize=0x80 | out: lpBuffer="") returned 0x15
[0119.579] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x19f1d8, nSize=0x80 | out: lpBuffer="") returned 0x15
[0119.616] EtwEventRegister (in: ProviderId=0x22fd5bc, EnableCallback=0x47a0746, CallbackContext=0x0, RegHandle=0x22fd598 | out: RegHandle=0x22fd598) returned 0x0
[0119.778] EtwEventSetInformation (RegHandle=0x7a9618, InformationClass=0x2b, EventInformation=0x2, InformationLength=0x22fd54c) returned 0x0
[0122.955] GetFullPathNameW (in: lpFileName="FindMe", nBufferLength=0x105, lpBuffer=0x19ee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\FindMe", lpFilePart=0x0) returned 0x24
[0122.956] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\FindMe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\findme")) returned 0
[0122.958] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x19f188, nSize=0xa8 | out: lpBuffer="") returned 0x24
[0124.080] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19ec14 | out: lpLuid=0x19ec14*(LowPart=0x14, HighPart=0)) returned 1
[0124.083] GetCurrentProcess () returned 0xffffffff
[0124.084] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19ec10 | out: TokenHandle=0x19ec10*=0x2ac) returned 1
[0124.085] AdjustTokenPrivileges (in: TokenHandle=0x2ac, DisableAllPrivileges=0, NewState=0x230121c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
[0124.088] CloseHandle (hObject=0x2ac) returned 1
[0124.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32e54d0, Length=0x20000, ResultLength=0x19f2f0 | out: SystemInformation=0x32e54d0, ResultLength=0x19f2f0*=0x178e0) returned 0x0
[0124.293] GetEnvironmentVariableW (in: lpName="WINDIR", lpBuffer=0x19f188, nSize=0xa8 | out: lpBuffer="") returned 0xa
[0124.358] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe.config", nBufferLength=0x105, lpBuffer=0x19ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe.config", lpFilePart=0x0) returned 0x69
[0124.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f098) returned 1
[0124.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f114 | out: lpFileInformation=0x19f114*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0124.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f094) returned 1
[0125.373] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x37e00, lpName=0x0) returned 0x2b0
[0125.377] CloseHandle (hObject=0x2b0) returned 1
[0125.714] GetACP () returned 0x4e4
[0126.303] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", nBufferLength=0x105, lpBuffer=0x19ee54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", lpFilePart=0x0) returned 0x33
[0126.304] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe")) returned 0
[0126.308] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe", nBufferLength=0x105, lpBuffer=0x19edfc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe", lpFilePart=0x0) returned 0x39
[0126.310] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19ede8, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16
[0126.311] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", nBufferLength=0x105, lpBuffer=0x19edfc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", lpFilePart=0x0) returned 0x33
[0126.311] CopyFileW (lpExistingFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\msbuild.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\msbuild.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe"), bFailIfExists=0) returned 1
[0129.615] CoTaskMemAlloc (cb=0xd) returned 0x7c6d28
[0129.615] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x23754a0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0129.616] LoadLibraryA (lpLibFileName="kernel32") returned 0x75600000
[0129.616] CoTaskMemFree (pv=0x7c6d28)
[0129.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x19cd10, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessAú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 14
[0129.643] GetProcAddress (hModule=0x75600000, lpProcName="CreateProcessA") returned 0x75640750
[0129.662] CoTaskMemAlloc (cb=0xd) returned 0x7c6c08
[0129.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2376ebc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0129.662] LoadLibraryA (lpLibFileName="kernel32") returned 0x75600000
[0129.663] CoTaskMemFree (pv=0x7c6c08)
[0129.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x19cd0c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemorynú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 17
[0129.663] GetProcAddress (hModule=0x75600000, lpProcName="ReadProcessMemory") returned 0x75641c80
[0129.674] CoTaskMemAlloc (cb=0xd) returned 0x7c6d28
[0129.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x23788dc, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0129.674] LoadLibraryA (lpLibFileName="kernel32") returned 0x75600000
[0129.674] CoTaskMemFree (pv=0x7c6d28)
[0129.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x19cd0c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemoryú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 18
[0129.674] GetProcAddress (hModule=0x75600000, lpProcName="WriteProcessMemory") returned 0x75642850
[0129.693] CoTaskMemAlloc (cb=0xd) returned 0x7c6b00
[0129.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x237a2f4, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0129.693] LoadLibraryA (lpLibFileName="kernel32") returned 0x75600000
[0129.694] CoTaskMemFree (pv=0x7c6b00)
[0129.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x19cd0c, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContextÅnú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 16
[0129.694] GetProcAddress (hModule=0x75600000, lpProcName="GetThreadContext") returned 0x7561ec60
[0129.702] CoTaskMemAlloc (cb=0xa) returned 0x7c6bc0
[0129.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x237bd0c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5
[0129.702] LoadLibraryA (lpLibFileName="ntdll") returned 0x77720000
[0129.702] CoTaskMemFree (pv=0x7c6bc0)
[0129.702] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NtSetContextThread", cchWideChar=18, lpMultiByteStr=0x19cd0c, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NtSetContextThreadú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 18
[0129.702] GetProcAddress (hModule=0x77720000, lpProcName="NtSetContextThread") returned 0x777983c0
[0129.706] CoTaskMemAlloc (cb=0xa) returned 0x7c6bd8
[0129.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x237d71c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5
[0129.706] LoadLibraryA (lpLibFileName="ntdll") returned 0x77720000
[0129.707] CoTaskMemFree (pv=0x7c6bd8)
[0129.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NtUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x19cd08, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NtUnmapViewOfSectionÅnú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 20
[0129.707] GetProcAddress (hModule=0x77720000, lpProcName="NtUnmapViewOfSection") returned 0x77796f40
[0129.709] CoTaskMemAlloc (cb=0xd) returned 0x7c6b00
[0129.709] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x237f048, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0129.709] LoadLibraryA (lpLibFileName="kernel32") returned 0x75600000
[0129.710] CoTaskMemFree (pv=0x7c6b00)
[0129.710] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x19cd10, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocExú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 14
[0129.710] GetProcAddress (hModule=0x75600000, lpProcName="VirtualAllocEx") returned 0x75642730
[0129.712] CoTaskMemAlloc (cb=0xa) returned 0x7c6b00
[0129.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x2380978, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5
[0129.712] LoadLibraryA (lpLibFileName="ntdll") returned 0x77720000
[0129.713] CoTaskMemFree (pv=0x7c6b00)
[0129.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NtResumeThread", cchWideChar=14, lpMultiByteStr=0x19cd10, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NtResumeThreadú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 14
[0129.713] GetProcAddress (hModule=0x77720000, lpProcName="NtResumeThread") returned 0x777971c0
[0129.715] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", cchWideChar=47, lpMultiByteStr=0x19cc64, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exelipú\x04³òÎä «@lhö\x19", lpUsedDefaultChar=0x0) returned 47
[0129.716] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe\"", cchWideChar=49, lpMultiByteStr=0x19cc30, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe\"Ì\x19", lpUsedDefaultChar=0x0) returned 49
[0129.716] CreateProcessA (in: lpApplicationName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", lpCommandLine="\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe\"", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19cccc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x23739ec | out: lpCommandLine="\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe\"", lpProcessInformation=0x23739ec*(hProcess=0x2b8, hThread=0x2b4, dwProcessId=0x82c, dwThreadId=0xbf8)) returned 1
[0129.887] CoTaskMemFree (pv=0x0)
[0129.888] GetThreadContext (in: hThread=0x2b4, lpContext=0x2380b38 | out: lpContext=0x2380b38*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x35e000, Edx=0x0, Ecx=0x0, Eax=0x439422, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
[0129.907] ReadProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x35e008, lpBuffer=0x19cdbc, nSize=0x4, lpNumberOfBytesRead=0x19cdac | out: lpBuffer=0x19cdbc*, lpNumberOfBytesRead=0x19cdac*=0x4) returned 1
[0129.918] NtUnmapViewOfSection (ProcessHandle=0x2b8, BaseAddress=0x400000) returned 0x0
[0129.959] VirtualAllocEx (hProcess=0x2b8, lpAddress=0x400000, dwSize=0x3a000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000
[0129.964] WriteProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x400000, lpBuffer=0x33a7750*, nSize=0x200, lpNumberOfBytesWritten=0x19cdac | out: lpBuffer=0x33a7750*, lpNumberOfBytesWritten=0x19cdac*=0x200) returned 1
[0129.996] WriteProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x402000, lpBuffer=0x33dc970*, nSize=0x1c000, lpNumberOfBytesWritten=0x19cdac | out: lpBuffer=0x33dc970*, lpNumberOfBytesWritten=0x19cdac*=0x1c000) returned 1
[0130.041] WriteProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x41e000, lpBuffer=0x33f8990*, nSize=0x18e00, lpNumberOfBytesWritten=0x19cdac | out: lpBuffer=0x33f8990*, lpNumberOfBytesWritten=0x19cdac*=0x18e00) returned 1
[0130.154] WriteProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x438000, lpBuffer=0x2380e10*, nSize=0x200, lpNumberOfBytesWritten=0x19cdac | out: lpBuffer=0x2380e10*, lpNumberOfBytesWritten=0x19cdac*=0x200) returned 1
[0130.339] WriteProcessMemory (in: hProcess=0x2b8, lpBaseAddress=0x35e008, lpBuffer=0x238101c*, nSize=0x4, lpNumberOfBytesWritten=0x19cdac | out: lpBuffer=0x238101c*, lpNumberOfBytesWritten=0x19cdac*=0x4) returned 1
[0130.354] NtSetContextThread (ThreadHandle=0x2b4, Context=0x2380b38*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x35e000, Edx=0x0, Ecx=0x0, Eax=0x41dea2, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0
[0130.358] NtResumeThread (in: ThreadHandle=0x2b4, SuspendCount=0x19dbac | out: SuspendCount=0x19dbac*=0x1) returned 0x0
[0146.596] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0
[0146.596] CObjectContext::QueryInterface () returned 0x0
[0146.597] CObjectContext::GetCurrentThreadType () returned 0x0
[0146.597] Release () returned 0x0
[0146.598] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x7783b8*=0x14c, lpdwindex=0x19f094)
Thread:
id = 2
os_tid = 0x674
Thread:
id = 3
os_tid = 0xb0c
Thread:
id = 4
os_tid = 0x600
[0113.471] CoGetContextToken (in: pToken=0x22afc3c | out: pToken=0x22afc3c) returned 0x800401f0
[0113.471] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0113.471] RoInitialize () returned 0x1
[0113.471] RoUninitialize () returned 0x0
[0146.735] EtwEventUnregister (RegHandle=0x7a9618) returned 0x0
[0146.790] CloseHandle (hObject=0x2b0) returned 1
[0146.791] UnmapViewOfFile (lpBaseAddress=0x22b0000) returned 1
Thread:
id = 10
os_tid = 0xd1c
Thread:
id = 11
os_tid = 0x5dc
Thread:
id = 12
os_tid = 0x1014
Process:
id = "2"
image_name = "svhost.exe"
filename = "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe"
page_root = "0x46bee000"
os_pid = "0x82c"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x464"
cmd_line = "\"C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe\""
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f72e" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 547
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 548
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 549
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 550
start_va = 0x60000
end_va = 0x9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 551
start_va = 0xa0000
end_va = 0x19ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 552
start_va = 0x1a0000
end_va = 0x1a3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001a0000"
filename = ""
Region:
id = 553
start_va = 0x1b0000
end_va = 0x1b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001b0000"
filename = ""
Region:
id = 554
start_va = 0x1c0000
end_va = 0x1c1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 555
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 556
start_va = 0x400000
end_va = 0x43ffff
monitored = 1
entry_point = 0x439422
region_type = mapped_file
name = "svhost.exe"
filename = "\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe")
Region:
id = 557
start_va = 0x77720000
end_va = 0x7789afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 558
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 559
start_va = 0xfffb0000
end_va = 0xfffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000fffb0000"
filename = ""
Region:
id = 560
start_va = 0xfffe0000
end_va = 0x7ff87ff9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000fffe0000"
filename = ""
Region:
id = 561
start_va = 0x7ff87ffa0000
end_va = 0x7ff880160fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 562
start_va = 0x7ff880161000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ff880161000"
filename = ""
Region:
id = 563
start_va = 0x400000
end_va = 0x439fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 564
start_va = 0x4f0000
end_va = 0x4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004f0000"
filename = ""
Region:
id = 565
start_va = 0x662d0000
end_va = 0x66349fff
monitored = 0
entry_point = 0x662e3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 566
start_va = 0x66350000
end_va = 0x6639ffff
monitored = 0
entry_point = 0x66368180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 567
start_va = 0x75600000
end_va = 0x756dffff
monitored = 0
entry_point = 0x75613980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 568
start_va = 0x663a0000
end_va = 0x663a7fff
monitored = 0
entry_point = 0x663a17c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 569
start_va = 0x500000
end_va = 0x73ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 570
start_va = 0x6cec0000
end_va = 0x6cf18fff
monitored = 1
entry_point = 0x6ced0780
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")
Region:
id = 571
start_va = 0x75600000
end_va = 0x756dffff
monitored = 0
entry_point = 0x75613980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 572
start_va = 0x75480000
end_va = 0x755fdfff
monitored = 0
entry_point = 0x75531b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 573
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 574
start_va = 0xffeb0000
end_va = 0xfffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000ffeb0000"
filename = ""
Region:
id = 575
start_va = 0x20000
end_va = 0x3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 576
start_va = 0x500000
end_va = 0x5bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 577
start_va = 0x640000
end_va = 0x73ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000640000"
filename = ""
Region:
id = 578
start_va = 0x7fff0000
end_va = 0x7fffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 579
start_va = 0x80000000
end_va = 0x8000ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000080000000"
filename = ""
Region:
id = 580
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 581
start_va = 0x30000
end_va = 0x3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 582
start_va = 0x74650000
end_va = 0x746cafff
monitored = 0
entry_point = 0x7466e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 583
start_va = 0x748c0000
end_va = 0x7497dfff
monitored = 0
entry_point = 0x748f5630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 584
start_va = 0x440000
end_va = 0x47ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000440000"
filename = ""
Region:
id = 585
start_va = 0x740000
end_va = 0x83ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000740000"
filename = ""
Region:
id = 586
start_va = 0x76ae0000
end_va = 0x76b23fff
monitored = 0
entry_point = 0x76af9d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 587
start_va = 0x75260000
end_va = 0x7530cfff
monitored = 0
entry_point = 0x75274f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 588
start_va = 0x74450000
end_va = 0x7446dfff
monitored = 0
entry_point = 0x7445b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 589
start_va = 0x74440000
end_va = 0x74449fff
monitored = 0
entry_point = 0x74442a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 590
start_va = 0x74590000
end_va = 0x745e7fff
monitored = 0
entry_point = 0x745d25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 591
start_va = 0x840000
end_va = 0x99ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000840000"
filename = ""
Region:
id = 592
start_va = 0x6ce40000
end_va = 0x6ceb8fff
monitored = 1
entry_point = 0x6ce4f82a
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")
Region:
id = 593
start_va = 0x77240000
end_va = 0x77284fff
monitored = 0
entry_point = 0x7725de90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 594
start_va = 0x77290000
end_va = 0x7744cfff
monitored = 0
entry_point = 0x77372a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 595
start_va = 0x76b30000
end_va = 0x76c7efff
monitored = 0
entry_point = 0x76be6820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 596
start_va = 0x77450000
end_va = 0x77596fff
monitored = 0
entry_point = 0x77461cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 597
start_va = 0x1d0000
end_va = 0x1f9fff
monitored = 0
entry_point = 0x1d5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 598
start_va = 0x9a0000
end_va = 0xb27fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000009a0000"
filename = ""
Region:
id = 599
start_va = 0x74ea0000
end_va = 0x74ecafff
monitored = 0
entry_point = 0x74ea5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 600
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 601
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 602
start_va = 0x480000
end_va = 0x4bffff
monitored = 1
entry_point = 0x4b9422
region_type = mapped_file
name = "svhost.exe"
filename = "\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe")
Region:
id = 603
start_va = 0xb30000
end_va = 0xcb0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000b30000"
filename = ""
Region:
id = 604
start_va = 0xcc0000
end_va = 0x20bffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000cc0000"
filename = ""
Region:
id = 605
start_va = 0x76e20000
end_va = 0x76e2bfff
monitored = 0
entry_point = 0x76e23930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 606
start_va = 0x6ce30000
end_va = 0x6ce37fff
monitored = 0
entry_point = 0x6ce317b0
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")
Region:
id = 607
start_va = 0x20c0000
end_va = 0x2770fff
monitored = 1
entry_point = 0x20d5d20
region_type = mapped_file
name = "clr.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")
Region:
id = 608
start_va = 0x6c400000
end_va = 0x6cab0fff
monitored = 1
entry_point = 0x6c415d20
region_type = mapped_file
name = "clr.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")
Region:
id = 609
start_va = 0x6cd30000
end_va = 0x6ce24fff
monitored = 0
entry_point = 0x6cd84160
region_type = mapped_file
name = "msvcr120_clr0400.dll"
filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll")
Region:
id = 610
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 611
start_va = 0x480000
end_va = 0x48ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000480000"
filename = ""
Region:
id = 612
start_va = 0x490000
end_va = 0x49ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000490000"
filename = ""
Region:
id = 613
start_va = 0x4a0000
end_va = 0x4affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004a0000"
filename = ""
Region:
id = 614
start_va = 0x4b0000
end_va = 0x4bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004b0000"
filename = ""
Region:
id = 615
start_va = 0x4c0000
end_va = 0x4cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004c0000"
filename = ""
Region:
id = 616
start_va = 0x4d0000
end_va = 0x4dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004d0000"
filename = ""
Region:
id = 617
start_va = 0x4e0000
end_va = 0x4e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004e0000"
filename = ""
Region:
id = 618
start_va = 0x5c0000
end_va = 0x5c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 619
start_va = 0x840000
end_va = 0x91ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000840000"
filename = ""
Region:
id = 620
start_va = 0x990000
end_va = 0x99ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000990000"
filename = ""
Region:
id = 621
start_va = 0x5d0000
end_va = 0x5dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005d0000"
filename = ""
Region:
id = 622
start_va = 0x5e0000
end_va = 0x61ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005e0000"
filename = ""
Region:
id = 623
start_va = 0x20c0000
end_va = 0x21bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020c0000"
filename = ""
Region:
id = 624
start_va = 0x620000
end_va = 0x62ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000620000"
filename = ""
Region:
id = 625
start_va = 0x21c0000
end_va = 0x41bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000021c0000"
filename = ""
Region:
id = 626
start_va = 0x840000
end_va = 0x8dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000840000"
filename = ""
Region:
id = 627
start_va = 0x910000
end_va = 0x91ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000910000"
filename = ""
Region:
id = 628
start_va = 0x920000
end_va = 0x95ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000920000"
filename = ""
Region:
id = 629
start_va = 0x41c0000
end_va = 0x42bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000041c0000"
filename = ""
Region:
id = 630
start_va = 0x42c0000
end_va = 0x45f6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 631
start_va = 0x6b1d0000
end_va = 0x6c3f7fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "mscorlib.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll")
Region:
id = 632
start_va = 0x74720000
end_va = 0x7480afff
monitored = 0
entry_point = 0x7475d650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 633
start_va = 0x4600000
end_va = 0x4690fff
monitored = 0
entry_point = 0x4638cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 634
start_va = 0x706b0000
end_va = 0x70724fff
monitored = 0
entry_point = 0x706e9a60
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 635
start_va = 0x620000
end_va = 0x62ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000620000"
filename = ""
Region:
id = 636
start_va = 0x630000
end_va = 0x63ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000630000"
filename = ""
Region:
id = 637
start_va = 0x6b150000
end_va = 0x6b1cdfff
monitored = 1
entry_point = 0x6b151140
region_type = mapped_file
name = "clrjit.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")
Region:
id = 638
start_va = 0x753c0000
end_va = 0x75451fff
monitored = 0
entry_point = 0x753f8cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 639
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 640
start_va = 0x6a7a0000
end_va = 0x6b14bfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll")
Region:
id = 641
start_va = 0x69e20000
end_va = 0x69facfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.drawing.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll")
Region:
id = 642
start_va = 0x691c0000
end_va = 0x69e18fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.windows.forms.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll")
Region:
id = 643
start_va = 0x8f0000
end_va = 0x8f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000008f0000"
filename = ""
Region:
id = 644
start_va = 0x8f0000
end_va = 0x8f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000008f0000"
filename = ""
Region:
id = 645
start_va = 0x4600000
end_va = 0x468efff
monitored = 0
entry_point = 0x460dd60
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll")
Region:
id = 646
start_va = 0x69120000
end_va = 0x691b1fff
monitored = 0
entry_point = 0x6912dd60
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll")
Region:
id = 647
start_va = 0x4600000
end_va = 0x47effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004600000"
filename = ""
Region:
id = 648
start_va = 0x900000
end_va = 0x900fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000900000"
filename = ""
Region:
id = 649
start_va = 0x4600000
end_va = 0x46bbfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004600000"
filename = ""
Region:
id = 650
start_va = 0x47e0000
end_va = 0x47effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047e0000"
filename = ""
Region:
id = 651
start_va = 0x900000
end_va = 0x903fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000900000"
filename = ""
Region:
id = 652
start_va = 0x960000
end_va = 0x963fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000960000"
filename = ""
Region:
id = 653
start_va = 0x47f0000
end_va = 0x49fafff
monitored = 0
entry_point = 0x489b0a0
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll")
Region:
id = 654
start_va = 0x6efe0000
end_va = 0x6f1eefff
monitored = 0
entry_point = 0x6f08b0a0
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll")
Region:
id = 655
start_va = 0x970000
end_va = 0x970fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 656
start_va = 0x980000
end_va = 0x981fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000980000"
filename = ""
Region:
id = 657
start_va = 0x47f0000
end_va = 0x492ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047f0000"
filename = ""
Region:
id = 658
start_va = 0x70740000
end_va = 0x7075cfff
monitored = 0
entry_point = 0x70743b10
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")
Region:
id = 659
start_va = 0x46c0000
end_va = 0x4721fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "mscorrc.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll")
Region:
id = 660
start_va = 0x68fb0000
end_va = 0x6911afff
monitored = 0
entry_point = 0x6901e360
region_type = mapped_file
name = "gdiplus.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll")
Region:
id = 661
start_va = 0x47f0000
end_va = 0x48affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047f0000"
filename = ""
Region:
id = 662
start_va = 0x4920000
end_va = 0x492ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004920000"
filename = ""
Region:
id = 663
start_va = 0x4730000
end_va = 0x476ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004730000"
filename = ""
Region:
id = 664
start_va = 0x4930000
end_va = 0x4a2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004930000"
filename = ""
Region:
id = 665
start_va = 0x6d090000
end_va = 0x6d280fff
monitored = 0
entry_point = 0x6d173cd0
region_type = mapped_file
name = "dwrite.dll"
filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll")
Region:
id = 666
start_va = 0x74470000
end_va = 0x7458efff
monitored = 0
entry_point = 0x744b5980
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")
Region:
id = 667
start_va = 0x4770000
end_va = 0x47b8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-system.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat")
Region:
id = 668
start_va = 0x970000
end_va = 0x973fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000970000"
filename = ""
Region:
id = 669
start_va = 0x4a30000
end_va = 0x5a2ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-fontface.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat")
Region:
id = 670
start_va = 0x47c0000
end_va = 0x47c3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047c0000"
filename = ""
Region:
id = 671
start_va = 0x5a30000
end_va = 0x5b2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005a30000"
filename = ""
Region:
id = 672
start_va = 0x5b30000
end_va = 0x5c2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005b30000"
filename = ""
Region:
id = 673
start_va = 0x5c30000
end_va = 0x6121fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000005c30000"
filename = ""
Region:
id = 674
start_va = 0x6130000
end_va = 0x61ecfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "micross.ttf"
filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf")
Region:
id = 675
start_va = 0x61f0000
end_va = 0x65effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000061f0000"
filename = ""
Region:
id = 676
start_va = 0x47d0000
end_va = 0x47d1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000047d0000"
filename = ""
Region:
id = 677
start_va = 0x47f0000
end_va = 0x47f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000047f0000"
filename = ""
Region:
id = 678
start_va = 0x4800000
end_va = 0x4804fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "user32.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui")
Region:
id = 679
start_va = 0x48a0000
end_va = 0x48affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000048a0000"
filename = ""
Region:
id = 680
start_va = 0x4810000
end_va = 0x4810fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004810000"
filename = ""
Region:
id = 681
start_va = 0x751c0000
end_va = 0x7524cfff
monitored = 0
entry_point = 0x75209b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 682
start_va = 0x4820000
end_va = 0x4820fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004820000"
filename = ""
Region:
id = 683
start_va = 0x4830000
end_va = 0x4887fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004830000"
filename = ""
Region:
id = 684
start_va = 0x4890000
end_va = 0x4890fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004890000"
filename = ""
Region:
id = 685
start_va = 0x65f0000
end_va = 0x762ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "staticcache.dat"
filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")
Region:
id = 686
start_va = 0x6d720000
end_va = 0x6d732fff
monitored = 0
entry_point = 0x6d729950
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 687
start_va = 0x6ffd0000
end_va = 0x6fffefff
monitored = 0
entry_point = 0x6ffe95e0
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 688
start_va = 0x740f0000
end_va = 0x7410afff
monitored = 0
entry_point = 0x740f9050
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 689
start_va = 0x48b0000
end_va = 0x48bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000048b0000"
filename = ""
Region:
id = 690
start_va = 0x6a080000
end_va = 0x6a791fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.core.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll")
Region:
id = 691
start_va = 0x48c0000
end_va = 0x48cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000048c0000"
filename = ""
Region:
id = 692
start_va = 0x48d0000
end_va = 0x48dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000048d0000"
filename = ""
Region:
id = 693
start_va = 0x756e0000
end_va = 0x76adefff
monitored = 0
entry_point = 0x7589b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 698
start_va = 0x75120000
end_va = 0x75156fff
monitored = 0
entry_point = 0x75123b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 699
start_va = 0x749a0000
end_va = 0x74e98fff
monitored = 0
entry_point = 0x74ba7610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 705
start_va = 0x75370000
end_va = 0x753b3fff
monitored = 0
entry_point = 0x75377410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 706
start_va = 0x75250000
end_va = 0x7525efff
monitored = 0
entry_point = 0x75252e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 709
start_va = 0x48b0000
end_va = 0x48bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000048b0000"
filename = ""
Region:
id = 710
start_va = 0x7630000
end_va = 0x772ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007630000"
filename = ""
Region:
id = 711
start_va = 0x48c0000
end_va = 0x48d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000048c0000"
filename = ""
Region:
id = 712
start_va = 0x68ec0000
end_va = 0x68faefff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.configuration.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\1b51e779650e38bb712f3e535efcf132\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\1b51e779650e38bb712f3e535efcf132\\system.configuration.ni.dll")
Region:
id = 713
start_va = 0x687a0000
end_va = 0x68eb5fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.xml.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\1f87b5140145c221b5201351fffc52d8\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\1f87b5140145c221b5201351fffc52d8\\system.xml.ni.dll")
Region:
id = 714
start_va = 0x69fd0000
end_va = 0x6a074fff
monitored = 0
entry_point = 0x69feac50
region_type = mapped_file
name = "rasapi32.dll"
filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll")
Region:
id = 715
start_va = 0x6cd00000
end_va = 0x6cd22fff
monitored = 0
entry_point = 0x6cd05570
region_type = mapped_file
name = "rasman.dll"
filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll")
Region:
id = 716
start_va = 0x6ccf0000
end_va = 0x6ccfffff
monitored = 0
entry_point = 0x6ccf3820
region_type = mapped_file
name = "rtutils.dll"
filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll")
Region:
id = 717
start_va = 0x75310000
end_va = 0x7536efff
monitored = 0
entry_point = 0x75314af0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")
Region:
id = 718
start_va = 0x71f30000
end_va = 0x71f7efff
monitored = 0
entry_point = 0x71f3d850
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll")
Region:
id = 719
start_va = 0x7730000
end_va = 0x780ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")
Region:
id = 720
start_va = 0x48e0000
end_va = 0x491ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000048e0000"
filename = ""
Region:
id = 721
start_va = 0x7810000
end_va = 0x790ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007810000"
filename = ""
Region:
id = 722
start_va = 0x70770000
end_va = 0x7080afff
monitored = 0
entry_point = 0x707af7e0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll")
Region:
id = 723
start_va = 0x7910000
end_va = 0x794ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007910000"
filename = ""
Region:
id = 724
start_va = 0x7950000
end_va = 0x7a4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007950000"
filename = ""
Region:
id = 725
start_va = 0x70810000
end_va = 0x70821fff
monitored = 0
entry_point = 0x70814510
region_type = mapped_file
name = "ondemandconnroutehelper.dll"
filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll")
Region:
id = 726
start_va = 0x71e70000
end_va = 0x71e9efff
monitored = 0
entry_point = 0x71e7bb70
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll")
Region:
id = 727
start_va = 0x74980000
end_va = 0x74986fff
monitored = 0
entry_point = 0x74981e10
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll")
Region:
id = 728
start_va = 0x71df0000
end_va = 0x71e02fff
monitored = 0
entry_point = 0x71df25d0
region_type = mapped_file
name = "dhcpcsvc6.dll"
filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll")
Region:
id = 729
start_va = 0x71dd0000
end_va = 0x71de3fff
monitored = 0
entry_point = 0x71dd3c10
region_type = mapped_file
name = "dhcpcsvc.dll"
filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll")
Region:
id = 730
start_va = 0x7a50000
end_va = 0x7a53fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007a50000"
filename = ""
Region:
id = 731
start_va = 0x7a60000
end_va = 0x7a9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007a60000"
filename = ""
Region:
id = 732
start_va = 0x7aa0000
end_va = 0x7b9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007aa0000"
filename = ""
Region:
id = 733
start_va = 0x7ba0000
end_va = 0x7bdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007ba0000"
filename = ""
Region:
id = 734
start_va = 0x7be0000
end_va = 0x7cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007be0000"
filename = ""
Region:
id = 735
start_va = 0x7ce0000
end_va = 0x7ce0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll"
filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")
Region:
id = 736
start_va = 0x7ce0000
end_va = 0x7ce8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")
Region:
id = 737
start_va = 0x7ce0000
end_va = 0x7ce0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll"
filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")
Region:
id = 738
start_va = 0x7ce0000
end_va = 0x7ce8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")
Region:
id = 739
start_va = 0x7ce0000
end_va = 0x7ce0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll"
filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")
Region:
id = 740
start_va = 0x7ce0000
end_va = 0x7ce8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")
Region:
id = 741
start_va = 0x7ce0000
end_va = 0x7d1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007ce0000"
filename = ""
Region:
id = 742
start_va = 0x7d20000
end_va = 0x7e1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007d20000"
filename = ""
Region:
id = 743
start_va = 0x686c0000
end_va = 0x68793fff
monitored = 1
entry_point = 0x686f3432
region_type = mapped_file
name = "diasymreader.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\diasymreader.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\diasymreader.dll")
Region:
id = 744
start_va = 0x7e20000
end_va = 0x7e23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007e20000"
filename = ""
Region:
id = 745
start_va = 0x7e30000
end_va = 0x7e34fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll"
filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll")
Region:
id = 746
start_va = 0x7e40000
end_va = 0x7e4ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui")
Region:
id = 747
start_va = 0x7e50000
end_va = 0x864ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-21-1560258661-3990802383-1811730007-1000.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-21-1560258661-3990802383-1811730007-1000.dat")
Region:
id = 748
start_va = 0x8650000
end_va = 0x865ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008650000"
filename = ""
Region:
id = 749
start_va = 0x68540000
end_va = 0x686b2fff
monitored = 0
entry_point = 0x685ed220
region_type = mapped_file
name = "windowscodecs.dll"
filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll")
Region:
id = 750
start_va = 0x8660000
end_va = 0x8660fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000008660000"
filename = ""
Region:
id = 751
start_va = 0x8660000
end_va = 0x86dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008660000"
filename = ""
Region:
id = 752
start_va = 0x86e0000
end_va = 0x86e2fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000086e0000"
filename = ""
Region:
id = 753
start_va = 0x86e0000
end_va = 0x8728fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000086e0000"
filename = ""
Region:
id = 754
start_va = 0x8730000
end_va = 0x8733fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008730000"
filename = ""
Region:
id = 755
start_va = 0x8740000
end_va = 0x8740fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008740000"
filename = ""
Region:
id = 756
start_va = 0x8750000
end_va = 0x8767fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008750000"
filename = ""
Region:
id = 757
start_va = 0x8730000
end_va = 0x8736fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008730000"
filename = ""
Thread:
id = 5
os_tid = 0xbf8
[0131.585] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
[0131.607] RoInitialize () returned 0x1
[0131.608] RoUninitialize () returned 0x0
[0133.054] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19ef18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77
[0133.107] IsAppThemed () returned 0x1
[0133.110] CoTaskMemAlloc (cb=0xf0) returned 0x68b088
[0133.110] CreateActCtxA (pActCtx=0x19f414) returned 0x689cf4
[0133.222] CoTaskMemFree (pv=0x68b088)
[0133.236] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc206
[0133.236] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc207
[0133.244] GetUserNameW (in: lpBuffer=0x19f25c, pcbBuffer=0x19f4d4 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f4d4) returned 1
[0133.248] GetComputerNameW (in: lpBuffer=0x19f25c, nSize=0x19f4d4 | out: lpBuffer="XC64ZB", nSize=0x19f4d4) returned 1
[0133.258] GetSystemMetrics (nIndex=75) returned 1
[0133.263] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0
[0134.103] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x69120000
[0134.194] AdjustWindowRectEx (in: lpRect=0x19f474, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19f474) returned 1
[0134.197] GetCurrentProcess () returned 0xffffffff
[0134.197] GetCurrentThread () returned 0xfffffffe
[0134.197] GetCurrentProcess () returned 0xffffffff
[0134.197] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f38c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f38c*=0x240) returned 1
[0134.202] GetCurrentThreadId () returned 0xbf8
[0134.218] GetCurrentActCtx (in: lphActCtx=0x19f2ec | out: lphActCtx=0x19f2ec*=0x0) returned 1
[0134.218] ActivateActCtx (in: hActCtx=0x689cf4, lpCookie=0x19f2fc | out: hActCtx=0x689cf4, lpCookie=0x19f2fc) returned 1
[0134.219] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0
[0135.484] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6efe0000
[0135.497] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77450000
[0135.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19f1b4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW;iD?ÀB «@lhö\x19", lpUsedDefaultChar=0x0) returned 14
[0135.497] GetProcAddress (hModule=0x77450000, lpProcName="DefWindowProcW") returned 0x777aaee0
[0135.498] GetStockObject (i=5) returned 0x1900015
[0135.521] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0135.526] CoTaskMemAlloc (cb=0x5c) returned 0x6a4688
[0135.526] RegisterClassW (lpWndClass=0x19f1a4) returned 0xc150
[0135.527] CoTaskMemFree (pv=0x6a4688)
[0135.527] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0135.528] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x9032e
[0135.529] SetWindowLongW (hWnd=0x9032e, nIndex=-4, dwNewLong=2004528864) returned 76678590
[0135.546] GetWindowLongW (hWnd=0x9032e, nIndex=-4) returned 2004528864
[0135.552] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea04 | out: phkResult=0x19ea04*=0x260) returned 0x0
[0135.553] RegQueryValueExW (in: hKey=0x260, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19ea24, lpData=0x0, lpcbData=0x19ea20*=0x0 | out: lpType=0x19ea24*=0x0, lpData=0x0, lpcbData=0x19ea20*=0x0) returned 0x2
[0135.553] RegQueryValueExW (in: hKey=0x260, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19ea24, lpData=0x0, lpcbData=0x19ea20*=0x0 | out: lpType=0x19ea24*=0x0, lpData=0x0, lpcbData=0x19ea20*=0x0) returned 0x2
[0135.553] RegCloseKey (hKey=0x260) returned 0x0
[0135.556] SetWindowLongW (hWnd=0x9032e, nIndex=-4, dwNewLong=76678630) returned 2004528864
[0135.556] GetWindowLongW (hWnd=0x9032e, nIndex=-4) returned 76678630
[0135.556] GetWindowLongW (hWnd=0x9032e, nIndex=-16) returned 113311744
[0135.557] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1d1
[0135.558] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x9032e, Msg=0x24, wParam=0x0, lParam=0x19ed1c) returned 0x0
[0135.558] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1d2
[0135.558] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x9032e, Msg=0x81, wParam=0x0, lParam=0x19ed10) returned 0x1
[0135.559] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x9032e, Msg=0x83, wParam=0x0, lParam=0x19ecfc) returned 0x0
[0135.862] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x9032e, Msg=0x1, wParam=0x0, lParam=0x19ed10) returned 0x0
[0135.863] GetClientRect (in: hWnd=0x9032e, lpRect=0x19ea3c | out: lpRect=0x19ea3c) returned 1
[0135.863] GetWindowRect (in: hWnd=0x9032e, lpRect=0x19ea3c | out: lpRect=0x19ea3c) returned 1
[0135.865] GetParent (hWnd=0x9032e) returned 0x0
[0135.865] DeactivateActCtx (dwFlags=0x0, ulCookie=0x15af0001) returned 1
[0135.981] EtwEventRegister (in: ProviderId=0x21c8d8c, EnableCallback=0x492060e, CallbackContext=0x0, RegHandle=0x21c8d68 | out: RegHandle=0x21c8d68) returned 0x0
[0135.985] EtwEventSetInformation (RegHandle=0x6505c0, InformationClass=0x1f, EventInformation=0x2, InformationLength=0x21c8cfc) returned 0x0
[0135.991] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69120000
[0135.991] AdjustWindowRectEx (in: lpRect=0x19f460, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f460) returned 1
[0136.023] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19ed4c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16
[0136.024] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", nBufferLength=0x105, lpBuffer=0x19ed60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", lpFilePart=0x0) returned 0x3a
[0136.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1f4) returned 1
[0136.027] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f270 | out: lpFileInformation=0x19f270*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0136.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1
[0136.535] GetSystemMetrics (nIndex=11) returned 32
[0136.535] GetSystemMetrics (nIndex=12) returned 32
[0136.536] GetDC (hWnd=0x0) returned 0x50107d3
[0136.540] GetDeviceCaps (hdc=0x50107d3, index=12) returned 32
[0136.540] GetDeviceCaps (hdc=0x50107d3, index=14) returned 1
[0136.541] ReleaseDC (hWnd=0x0, hDC=0x50107d3) returned 1
[0136.541] CreateIconFromResourceEx (presbits=0x21dc1dc, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x53008f
[0136.545] CreateCompatibleDC (hdc=0x0) returned 0x470108fc
[0136.547] GetSystemDefaultLCID () returned 0x409
[0136.547] GetStockObject (i=17) returned 0x10a0047
[0136.550] GetObjectW (in: h=0x10a0047, c=92, pv=0x19f1b8 | out: pv=0x19f1b8) returned 92
[0136.550] GetDC (hWnd=0x0) returned 0x50107d3
[0137.368] GdiplusStartup (in: token=0x4b5e98, input=0x19e780, output=0x19e7d0 | out: token=0x4b5e98, output=0x19e7d0) returned 0x0
[0137.377] CoTaskMemAlloc (cb=0x5c) returned 0x6a41a8
[0137.379] GdipCreateFontFromLogfontW (hdc=0x50107d3, logfont=0x6a41a8, font=0x19f280) returned 0x0
[0138.689] CoTaskMemFree (pv=0x6a41a8)
[0138.690] CoTaskMemAlloc (cb=0x5c) returned 0x6a4620
[0138.691] CoTaskMemFree (pv=0x6a4620)
[0138.691] CoTaskMemAlloc (cb=0x5c) returned 0x6a42e0
[0138.691] CoTaskMemFree (pv=0x6a42e0)
[0138.691] GdipGetFontUnit (font=0x48a1f08, unit=0x19f24c) returned 0x0
[0138.692] GdipGetFontSize (font=0x48a1f08, size=0x19f250) returned 0x0
[0138.715] GdipGetFontStyle (font=0x48a1f08, style=0x19f248) returned 0x0
[0138.715] GdipGetFamily (font=0x48a1f08, family=0x19f244) returned 0x0
[0138.716] GdipGetFontSize (font=0x48a1f08, size=0x21dd748) returned 0x0
[0138.716] ReleaseDC (hWnd=0x0, hDC=0x50107d3) returned 1
[0138.717] GetDC (hWnd=0x0) returned 0x9010784
[0138.717] GdipCreateFromHDC (hdc=0x9010784, graphics=0x19f26c) returned 0x0
[0138.724] GdipGetDpiY (graphics=0x5b3f268, dpi=0x21dd850) returned 0x0
[0138.724] GdipGetFontHeight (font=0x48a1f08, graphics=0x5b3f268, height=0x19f264) returned 0x0
[0138.725] GdipGetEmHeight (family=0x5b350a0, style=0, EmHeight=0x19f26c) returned 0x0
[0138.725] GdipGetLineSpacing (family=0x5b350a0, style=0, LineSpacing=0x19f26c) returned 0x0
[0138.726] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0
[0138.727] ReleaseDC (hWnd=0x0, hDC=0x9010784) returned 1
[0138.728] GdipCreateFont (fontFamily=0x5b350a0, emSize=0x41040000, style=0, unit=0x3, font=0x21dd810) returned 0x0
[0138.728] GdipGetFontSize (font=0x48aefc0, size=0x21dd814) returned 0x0
[0138.728] GdipDeleteFont (font=0x48a1f08) returned 0x0
[0138.728] GetDC (hWnd=0x0) returned 0x9010784
[0138.729] GdipCreateFromHDC (hdc=0x9010784, graphics=0x19f290) returned 0x0
[0138.729] CoTaskMemAlloc (cb=0x5c) returned 0x6a4278
[0138.731] GdipGetLogFontW (font=0x48aefc0, graphics=0x5b3f268, logfontW=0x6a4278) returned 0x0
[0138.735] CoTaskMemFree (pv=0x6a4278)
[0138.735] CoTaskMemAlloc (cb=0x5c) returned 0x6a4418
[0138.736] CoTaskMemFree (pv=0x6a4418)
[0138.736] CoTaskMemAlloc (cb=0x5c) returned 0x6a42e0
[0138.736] CoTaskMemFree (pv=0x6a42e0)
[0138.736] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0
[0138.736] ReleaseDC (hWnd=0x0, hDC=0x9010784) returned 1
[0138.767] CoTaskMemAlloc (cb=0x5c) returned 0x6a40d8
[0138.768] CreateFontIndirectW (lplf=0x6a40d8) returned 0x3a0a09ab
[0138.768] CoTaskMemFree (pv=0x6a40d8)
[0138.768] SelectObject (hdc=0x470108fc, h=0x3a0a09ab) returned 0x18a0048
[0138.769] GetTextMetricsW (in: hdc=0x470108fc, lptm=0x19f39c | out: lptm=0x19f39c) returned 1
[0138.769] GetTextExtentPoint32W (in: hdc=0x470108fc, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x21dda6c | out: psizl=0x21dda6c) returned 1
[0138.771] SelectObject (hdc=0x470108fc, h=0x18a0048) returned 0x3a0a09ab
[0138.773] DeleteDC (hdc=0x470108fc) returned 1
[0138.774] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69120000
[0138.774] AdjustWindowRectEx (in: lpRect=0x19f108, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f108) returned 1
[0138.774] AdjustWindowRectEx (in: lpRect=0x19f328, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f328) returned 1
[0138.775] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69120000
[0138.775] AdjustWindowRectEx (in: lpRect=0x19f080, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f080) returned 1
[0138.775] AdjustWindowRectEx (in: lpRect=0x19f160, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f160) returned 1
[0138.776] GetSystemMetrics (nIndex=34) returned 136
[0138.776] GetSystemMetrics (nIndex=35) returned 39
[0138.777] GetCurrentActCtx (in: lphActCtx=0x19f48c | out: lphActCtx=0x19f48c*=0x0) returned 1
[0138.777] ActivateActCtx (in: hActCtx=0x689cf4, lpCookie=0x19f49c | out: hActCtx=0x689cf4, lpCookie=0x19f49c) returned 1
[0138.777] GetCurrentActCtx (in: lphActCtx=0x19f2ac | out: lphActCtx=0x19f2ac*=0x689cf4) returned 1
[0138.778] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0138.778] AdjustWindowRectEx (in: lpRect=0x19f210, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f210) returned 1
[0138.778] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0138.778] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="notepad", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=300, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x601fc
[0138.779] SetWindowLongW (hWnd=0x601fc, nIndex=-4, dwNewLong=2004528864) returned 76678590
[0138.779] GetWindowLongW (hWnd=0x601fc, nIndex=-4) returned 2004528864
[0138.780] SetWindowLongW (hWnd=0x601fc, nIndex=-4, dwNewLong=76678710) returned 2004528864
[0138.780] GetWindowLongW (hWnd=0x601fc, nIndex=-4) returned 76678710
[0138.780] GetWindowLongW (hWnd=0x601fc, nIndex=-16) returned 114229248
[0138.780] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x81, wParam=0x0, lParam=0x19ecd0) returned 0x1
[0138.783] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x83, wParam=0x0, lParam=0x19ecbc) returned 0x0
[0138.785] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x1, wParam=0x0, lParam=0x19ecd0) returned 0x0
[0138.785] GetClientRect (in: hWnd=0x601fc, lpRect=0x19e9cc | out: lpRect=0x19e9cc) returned 1
[0138.785] GetWindowRect (in: hWnd=0x601fc, lpRect=0x19e9cc | out: lpRect=0x19e9cc) returned 1
[0138.786] SetWindowTextW (hWnd=0x601fc, lpString="notepad") returned 1
[0138.786] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xc, wParam=0x0, lParam=0x21c89e0) returned 0x1
[0138.800] GetProcessWindowStation () returned 0xd0
[0138.804] GetUserObjectInformationA (in: hObj=0xd0, nIndex=1, pvInfo=0x21ddf88, nLength=0xc, lpnLengthNeeded=0x19e8cc | out: pvInfo=0x21ddf88, lpnLengthNeeded=0x19e8cc) returned 1
[0138.808] SetConsoleCtrlHandler (HandlerRoutine=0x492065e, Add=1) returned 1
[0138.809] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0138.811] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0138.813] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x21ddfec | out: lpWndClass=0x21ddfec) returned 0
[0138.816] CoTaskMemAlloc (cb=0x58) returned 0x68cb88
[0138.816] RegisterClassW (lpWndClass=0x19e81c) returned 0xc208
[0138.816] CoTaskMemFree (pv=0x68cb88)
[0138.818] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x40200
[0138.818] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x81, wParam=0x0, lParam=0x19e358) returned 0x1
[0138.819] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x83, wParam=0x0, lParam=0x19e344) returned 0x0
[0138.820] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x1, wParam=0x0, lParam=0x19e358) returned 0x0
[0138.820] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0
[0138.820] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
[0138.825] GetStartupInfoW (in: lpStartupInfo=0x21de440 | out: lpStartupInfo=0x21de440*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0))
[0138.826] GetParent (hWnd=0x601fc) returned 0x0
[0138.826] SetWindowLongW (hWnd=0x601fc, nIndex=-8, dwNewLong=0) returned 0
[0138.829] GetSystemMetrics (nIndex=49) returned 16
[0138.829] GetSystemMetrics (nIndex=50) returned 16
[0138.829] CreateIconFromResourceEx (presbits=0x21de4c0, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xb0205
[0138.831] SendMessageW (hWnd=0x601fc, Msg=0x80, wParam=0x0, lParam=0xb0205) returned 0x0
[0138.831] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x80, wParam=0x0, lParam=0xb0205) returned 0x0
[0138.832] SendMessageW (hWnd=0x601fc, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0
[0138.832] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0
[0138.832] GetSystemMenu (hWnd=0x601fc, bRevert=0) returned 0x80139
[0138.850] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19f2bc | out: lpwndpl=0x19f2bc) returned 1
[0138.850] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf020, uEnable=0x0) returned 0
[0138.851] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf030, uEnable=0x0) returned 0
[0138.851] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf060, uEnable=0x0) returned 0
[0138.851] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf120, uEnable=0x1) returned 0
[0138.851] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf000, uEnable=0x0) returned 0
[0138.851] GetClientRect (in: hWnd=0x601fc, lpRect=0x19f300 | out: lpRect=0x19f300) returned 1
[0138.851] GetClientRect (in: hWnd=0x601fc, lpRect=0x19f260 | out: lpRect=0x19f260) returned 1
[0138.851] GetWindowRect (in: hWnd=0x601fc, lpRect=0x19f260 | out: lpRect=0x19f260) returned 1
[0138.852] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0138.894] GetWindowLongW (hWnd=0x601fc, nIndex=-16) returned 114229248
[0138.894] GetWindowTextLengthW (hWnd=0x601fc) returned 7
[0138.894] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0138.894] GetSystemMetrics (nIndex=42) returned 0
[0138.895] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19f200, nMaxCount=8 | out: lpString="notepad") returned 7
[0138.895] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19f200) returned 0x7
[0138.896] GetWindowTextLengthW (hWnd=0x601fc) returned 7
[0138.896] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0138.896] GetSystemMetrics (nIndex=42) returned 0
[0138.896] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19f200, nMaxCount=8 | out: lpString="notepad") returned 7
[0138.896] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19f200) returned 0x7
[0138.896] GetWindowLongW (hWnd=0x601fc, nIndex=-16) returned 114229248
[0138.896] GetWindowLongW (hWnd=0x601fc, nIndex=-20) returned 327936
[0138.897] SetWindowLongW (hWnd=0x601fc, nIndex=-16, dwNewLong=47120384) returned 114229248
[0138.897] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7c, wParam=0xfffffff0, lParam=0x19f254) returned 0x0
[0138.897] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7d, wParam=0xfffffff0, lParam=0x19f254) returned 0x0
[0138.926] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0xb0205
[0138.927] SetWindowLongW (hWnd=0x601fc, nIndex=-20, dwNewLong=327680) returned 327936
[0138.927] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7c, wParam=0xffffffec, lParam=0x19f254) returned 0x0
[0138.928] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7d, wParam=0xffffffec, lParam=0x19f254) returned 0x0
[0138.930] SetWindowPos (hWnd=0x601fc, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1
[0138.930] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x46, wParam=0x0, lParam=0x19f274) returned 0x0
[0138.930] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x83, wParam=0x1, lParam=0x19f24c) returned 0x0
[0138.937] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19efe4 | out: lpwndpl=0x19efe4) returned 1
[0138.937] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x47, wParam=0x0, lParam=0x19f274) returned 0x0
[0138.937] GetClientRect (in: hWnd=0x601fc, lpRect=0x19ef94 | out: lpRect=0x19ef94) returned 1
[0138.937] GetWindowRect (in: hWnd=0x601fc, lpRect=0x19ef94 | out: lpRect=0x19ef94) returned 1
[0138.939] RedrawWindow (hWnd=0x601fc, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0138.939] GetSystemMenu (hWnd=0x601fc, bRevert=0) returned 0x80139
[0138.939] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19f2ac | out: lpwndpl=0x19f2ac) returned 1
[0138.939] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf020, uEnable=0x0) returned 0
[0138.940] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf030, uEnable=0x0) returned 0
[0138.940] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf060, uEnable=0x0) returned 0
[0138.940] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf120, uEnable=0x1) returned 1
[0138.940] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf000, uEnable=0x0) returned 0
[0138.940] ShowWindow (hWnd=0x601fc, nCmdShow=5) returned 0
[0138.940] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0138.944] GetWindowTextLengthW (hWnd=0x601fc) returned 7
[0138.944] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0138.944] GetSystemMetrics (nIndex=42) returned 0
[0138.944] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19eee8, nMaxCount=8 | out: lpString="notepad") returned 7
[0138.944] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19eee8) returned 0x7
[0138.965] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0138.966] GetWindowLongW (hWnd=0x601fc, nIndex=-16) returned 114229248
[0138.966] GetWindowTextLengthW (hWnd=0x601fc) returned 7
[0138.966] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0138.966] GetSystemMetrics (nIndex=42) returned 0
[0138.966] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19edec, nMaxCount=8 | out: lpString="notepad") returned 7
[0138.966] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19edec) returned 0x7
[0138.966] GetWindowTextLengthW (hWnd=0x601fc) returned 7
[0138.966] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0138.966] GetSystemMetrics (nIndex=42) returned 0
[0138.967] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19edec, nMaxCount=8 | out: lpString="notepad") returned 7
[0138.967] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19edec) returned 0x7
[0138.967] GetWindowLongW (hWnd=0x601fc, nIndex=-16) returned 114229248
[0138.967] GetWindowLongW (hWnd=0x601fc, nIndex=-20) returned 327936
[0138.967] SetWindowLongW (hWnd=0x601fc, nIndex=-16, dwNewLong=315555840) returned 114229248
[0138.967] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7c, wParam=0xfffffff0, lParam=0x19ee44) returned 0x0
[0138.993] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7d, wParam=0xfffffff0, lParam=0x19ee44) returned 0x0
[0138.994] SetWindowLongW (hWnd=0x601fc, nIndex=-20, dwNewLong=851968) returned 327936
[0138.994] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7c, wParam=0xffffffec, lParam=0x19ee44) returned 0x0
[0138.995] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x7d, wParam=0xffffffec, lParam=0x19ee44) returned 0x0
[0139.001] SetWindowPos (hWnd=0x601fc, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1
[0139.002] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x46, wParam=0x0, lParam=0x19ee64) returned 0x0
[0139.002] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x83, wParam=0x1, lParam=0x19ee3c) returned 0x0
[0139.004] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x85, wParam=0xe0408e2, lParam=0x0) returned 0x0
[0139.005] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19ebf0 | out: lpwndpl=0x19ebf0) returned 1
[0139.006] GetClientRect (in: hWnd=0x601fc, lpRect=0x19eb9c | out: lpRect=0x19eb9c) returned 1
[0139.006] GetWindowTextLengthW (hWnd=0x601fc) returned 7
[0139.006] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0139.006] GetSystemMetrics (nIndex=42) returned 0
[0139.006] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19ea64, nMaxCount=8 | out: lpString="notepad") returned 7
[0139.006] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19ea64) returned 0x7
[0139.006] GetClientRect (in: hWnd=0x601fc, lpRect=0x19eaa4 | out: lpRect=0x19eaa4) returned 1
[0139.018] GetSysColor (nIndex=10) returned 0xb4b4b4
[0139.018] GetSysColor (nIndex=2) returned 0xd1b499
[0139.018] GetSysColor (nIndex=9) returned 0x0
[0139.018] GetSysColor (nIndex=12) returned 0xababab
[0139.018] GetSysColor (nIndex=15) returned 0xf0f0f0
[0139.018] GetSysColor (nIndex=20) returned 0xffffff
[0139.018] GetSysColor (nIndex=16) returned 0xa0a0a0
[0139.018] GetSysColor (nIndex=15) returned 0xf0f0f0
[0139.018] GetSysColor (nIndex=16) returned 0xa0a0a0
[0139.019] GetSysColor (nIndex=21) returned 0x696969
[0139.019] GetSysColor (nIndex=22) returned 0xe3e3e3
[0139.019] GetSysColor (nIndex=20) returned 0xffffff
[0139.019] GetSysColor (nIndex=18) returned 0x0
[0139.019] GetSysColor (nIndex=1) returned 0x0
[0139.019] GetSysColor (nIndex=27) returned 0xead1b9
[0139.019] GetSysColor (nIndex=28) returned 0xf2e4d7
[0139.019] GetSysColor (nIndex=17) returned 0x6d6d6d
[0139.019] GetSysColor (nIndex=13) returned 0xff9933
[0139.019] GetSysColor (nIndex=14) returned 0xffffff
[0139.019] GetSysColor (nIndex=26) returned 0xcc6600
[0139.019] GetSysColor (nIndex=11) returned 0xfcf7f4
[0139.019] GetSysColor (nIndex=3) returned 0xdbcdbf
[0139.019] GetSysColor (nIndex=19) returned 0x0
[0139.020] GetSysColor (nIndex=24) returned 0xe1ffff
[0139.020] GetSysColor (nIndex=23) returned 0x0
[0139.020] GetSysColor (nIndex=4) returned 0xf0f0f0
[0139.020] GetSysColor (nIndex=30) returned 0xf0f0f0
[0139.020] GetSysColor (nIndex=29) returned 0xff9933
[0139.020] GetSysColor (nIndex=7) returned 0x0
[0139.020] GetSysColor (nIndex=0) returned 0xc8c8c8
[0139.020] GetSysColor (nIndex=5) returned 0xffffff
[0139.020] GetSysColor (nIndex=6) returned 0x646464
[0139.020] GetSysColor (nIndex=8) returned 0x0
[0139.022] GetSystemMetrics (nIndex=80) returned 1
[0139.031] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x49206ae, dwData=0x0) returned 1
[0139.042] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e704 | out: lpmi=0x19e704) returned 1
[0139.044] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x24010999
[0139.044] GetDeviceCaps (hdc=0x24010999, index=12) returned 32
[0139.045] GetDeviceCaps (hdc=0x24010999, index=14) returned 1
[0139.045] DeleteDC (hdc=0x24010999) returned 1
[0139.045] GetCurrentObject (hdc=0xd001053c, type=0x1) returned 0x1b00017
[0139.045] GetCurrentObject (hdc=0xd001053c, type=0x2) returned 0x1900010
[0139.046] GetCurrentObject (hdc=0xd001053c, type=0x7) returned 0x350506d2
[0139.046] GetCurrentObject (hdc=0xd001053c, type=0x6) returned 0x18a0048
[0139.046] SaveDC (hdc=0xd001053c) returned 1
[0139.047] GetNearestColor (hdc=0xd001053c, color=0xf0f0f0) returned 0xf0f0f0
[0139.048] CreateSolidBrush (color=0xf0f0f0) returned 0xc1008ec
[0139.049] FillRect (hDC=0xd001053c, lprc=0x19e944, hbr=0xc1008ec) returned 1
[0139.050] DeleteObject (ho=0xc1008ec) returned 1
[0139.050] RestoreDC (hdc=0xd001053c, nSavedDC=-1) returned 1
[0139.051] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19ebd4 | out: lpwndpl=0x19ebd4) returned 1
[0139.052] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x47, wParam=0x0, lParam=0x19ee64) returned 0x0
[0139.052] GetClientRect (in: hWnd=0x601fc, lpRect=0x19eb84 | out: lpRect=0x19eb84) returned 1
[0139.052] GetWindowRect (in: hWnd=0x601fc, lpRect=0x19eb84 | out: lpRect=0x19eb84) returned 1
[0139.053] RedrawWindow (hWnd=0x601fc, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0139.054] GetSystemMenu (hWnd=0x601fc, bRevert=0) returned 0x80139
[0139.054] GetWindowPlacement (in: hWnd=0x601fc, lpwndpl=0x19ee98 | out: lpwndpl=0x19ee98) returned 1
[0139.054] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf020, uEnable=0x0) returned 0
[0139.054] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf030, uEnable=0x0) returned 0
[0139.054] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf060, uEnable=0x0) returned 0
[0139.054] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf120, uEnable=0x1) returned 1
[0139.054] EnableMenuItem (hMenu=0x80139, uIDEnableItem=0xf000, uEnable=0x0) returned 0
[0139.193] SetLayeredWindowAttributes (hwnd=0x601fc, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1
[0139.207] GetCurrentThreadId () returned 0xbf8
[0139.227] EnumThreadWindows (dwThreadId=0xbf8, lpfn=0x49206d6, lParam=0x601fc) returned 1
[0139.339] GetWindowLongW (hWnd=0x40200, nIndex=-8) returned 0
[0139.339] GetWindowLongW (hWnd=0x601fc, nIndex=-8) returned 0
[0139.339] GetWindowLongW (hWnd=0xc01e4, nIndex=-8) returned 393724
[0139.502] SetWindowLongW (hWnd=0xc01e4, nIndex=-8, dwNewLong=0) returned 393724
[0139.515] GetFocus () returned 0x0
[0139.515] GetParent (hWnd=0x601fc) returned 0x0
[0139.515] GetWindowLongW (hWnd=0x601fc, nIndex=-20) returned 852224
[0139.516] DestroyWindow (hWnd=0x601fc) returned 1
[0139.517] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0
[0139.538] GetWindowTextLengthW (hWnd=0x601fc) returned 7
[0139.538] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0139.538] GetSystemMetrics (nIndex=42) returned 0
[0139.538] GetWindowTextW (in: hWnd=0x601fc, lpString=0x19e9e8, nMaxCount=8 | out: lpString="notepad") returned 7
[0139.538] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0xd, wParam=0x8, lParam=0x19e9e8) returned 0x7
[0139.545] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0139.546] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fc, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0139.549] GetCurrentActCtx (in: lphActCtx=0x19edf8 | out: lphActCtx=0x19edf8*=0x689cf4) returned 1
[0139.549] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0139.550] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0139.550] CreateWindowExW (dwExStyle=0x90000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="notepad", dwStyle=0x2cf0000, X=156, Y=156, nWidth=300, nHeight=300, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x802a2
[0139.550] SetWindowLongW (hWnd=0x802a2, nIndex=-4, dwNewLong=2004528864) returned 76678590
[0139.551] GetWindowLongW (hWnd=0x802a2, nIndex=-4) returned 2004528864
[0139.552] SetWindowLongW (hWnd=0x802a2, nIndex=-4, dwNewLong=76678910) returned 2004528864
[0139.552] GetWindowLongW (hWnd=0x802a2, nIndex=-4) returned 76678910
[0139.552] GetWindowLongW (hWnd=0x802a2, nIndex=-16) returned 114229248
[0139.554] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x81, wParam=0x0, lParam=0x19e818) returned 0x1
[0139.560] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x83, wParam=0x0, lParam=0x19e804) returned 0x0
[0139.561] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x1, wParam=0x0, lParam=0x19e818) returned 0x0
[0139.561] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e514 | out: lpRect=0x19e514) returned 1
[0139.561] GetWindowRect (in: hWnd=0x802a2, lpRect=0x19e514 | out: lpRect=0x19e514) returned 1
[0139.562] SetWindowTextW (hWnd=0x802a2, lpString="notepad") returned 1
[0139.562] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xc, wParam=0x0, lParam=0x21df8a8) returned 0x1
[0139.562] SetLayeredWindowAttributes (hwnd=0x802a2, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1
[0139.570] GetStartupInfoW (in: lpStartupInfo=0x21dfb7c | out: lpStartupInfo=0x21dfb7c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0))
[0139.572] GetParent (hWnd=0x802a2) returned 0x0
[0139.572] GetStockObject (i=5) returned 0x1900015
[0139.573] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0139.573] CoTaskMemAlloc (cb=0x5c) returned 0x6a4620
[0139.573] RegisterClassW (lpWndClass=0x19ecd8) returned 0xc209
[0139.573] CoTaskMemFree (pv=0x6a4620)
[0139.574] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0139.574] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x7032c
[0139.574] SetWindowLongW (hWnd=0x7032c, nIndex=-4, dwNewLong=2004528864) returned 76678950
[0139.574] GetWindowLongW (hWnd=0x7032c, nIndex=-4) returned 2004528864
[0139.575] SetWindowLongW (hWnd=0x7032c, nIndex=-4, dwNewLong=76678990) returned 2004528864
[0139.575] GetWindowLongW (hWnd=0x7032c, nIndex=-4) returned 76678990
[0139.575] GetWindowLongW (hWnd=0x7032c, nIndex=-16) returned 79691776
[0139.576] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x24, wParam=0x0, lParam=0x19e84c) returned 0x0
[0139.576] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x81, wParam=0x0, lParam=0x19e840) returned 0x1
[0139.577] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x83, wParam=0x0, lParam=0x19e82c) returned 0x0
[0139.578] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x1, wParam=0x0, lParam=0x19e840) returned 0x0
[0139.579] SetWindowLongW (hWnd=0x802a2, nIndex=-8, dwNewLong=459564) returned 0
[0139.582] SendMessageW (hWnd=0x802a2, Msg=0x80, wParam=0x0, lParam=0xb0205) returned 0x0
[0139.582] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x80, wParam=0x0, lParam=0xb0205) returned 0x0
[0139.582] SendMessageW (hWnd=0x802a2, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0
[0139.582] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0
[0139.583] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0xb0205
[0139.665] GetSystemMenu (hWnd=0x802a2, bRevert=0) returned 0x90139
[0139.666] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19ee08 | out: lpwndpl=0x19ee08) returned 1
[0139.666] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf020, uEnable=0x0) returned 0
[0139.666] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf030, uEnable=0x0) returned 0
[0139.666] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf060, uEnable=0x0) returned 0
[0139.666] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf120, uEnable=0x1) returned 0
[0139.666] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf000, uEnable=0x0) returned 0
[0139.666] GetClientRect (in: hWnd=0x802a2, lpRect=0x19ee4c | out: lpRect=0x19ee4c) returned 1
[0139.666] GetClientRect (in: hWnd=0x802a2, lpRect=0x19edac | out: lpRect=0x19edac) returned 1
[0139.666] GetWindowRect (in: hWnd=0x802a2, lpRect=0x19edac | out: lpRect=0x19edac) returned 1
[0139.666] SetWindowPos (hWnd=0x802a2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1
[0139.666] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x46, wParam=0x0, lParam=0x19ed14) returned 0x0
[0139.675] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0139.678] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19eaa0 | out: lpwndpl=0x19eaa0) returned 1
[0139.678] GetClientRect (in: hWnd=0x802a2, lpRect=0x19ea4c | out: lpRect=0x19ea4c) returned 1
[0139.678] GetWindowTextLengthW (hWnd=0x802a2) returned 7
[0139.678] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0139.678] GetSystemMetrics (nIndex=42) returned 0
[0139.678] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e914, nMaxCount=8 | out: lpString="notepad") returned 7
[0139.678] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e914) returned 0x7
[0139.678] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e954 | out: lpRect=0x19e954) returned 1
[0139.678] GetCurrentObject (hdc=0xd001053c, type=0x1) returned 0x1b00017
[0139.678] GetCurrentObject (hdc=0xd001053c, type=0x2) returned 0x1900010
[0139.678] GetCurrentObject (hdc=0xd001053c, type=0x7) returned 0x360506d2
[0139.678] GetCurrentObject (hdc=0xd001053c, type=0x6) returned 0x18a0048
[0139.678] SaveDC (hdc=0xd001053c) returned 1
[0139.679] GetNearestColor (hdc=0xd001053c, color=0xf0f0f0) returned 0xf0f0f0
[0139.679] CreateSolidBrush (color=0xf0f0f0) returned 0xd1008ec
[0139.679] FillRect (hDC=0xd001053c, lprc=0x19e7f4, hbr=0xd1008ec) returned 1
[0139.679] DeleteObject (ho=0xd1008ec) returned 1
[0139.679] RestoreDC (hdc=0xd001053c, nSavedDC=-1) returned 1
[0139.680] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19ea84 | out: lpwndpl=0x19ea84) returned 1
[0139.680] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x47, wParam=0x0, lParam=0x19ed14) returned 0x0
[0139.680] GetClientRect (in: hWnd=0x802a2, lpRect=0x19ea34 | out: lpRect=0x19ea34) returned 1
[0139.680] GetWindowRect (in: hWnd=0x802a2, lpRect=0x19ea34 | out: lpRect=0x19ea34) returned 1
[0139.683] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x83, wParam=0x1, lParam=0x19e864) returned 0x0
[0139.696] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0139.701] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19e618 | out: lpwndpl=0x19e618) returned 1
[0139.701] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e5c4 | out: lpRect=0x19e5c4) returned 1
[0139.701] GetWindowTextLengthW (hWnd=0x802a2) returned 7
[0139.701] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0139.704] GetSystemMetrics (nIndex=42) returned 0
[0139.704] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e48c, nMaxCount=8 | out: lpString="notepad") returned 7
[0139.705] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e48c) returned 0x7
[0139.705] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e4cc | out: lpRect=0x19e4cc) returned 1
[0139.705] GetCurrentObject (hdc=0x110106ca, type=0x1) returned 0x1b00017
[0139.705] GetCurrentObject (hdc=0x110106ca, type=0x2) returned 0x1900010
[0139.705] GetCurrentObject (hdc=0x110106ca, type=0x7) returned 0x360506d2
[0139.705] GetCurrentObject (hdc=0x110106ca, type=0x6) returned 0x18a0048
[0139.705] SaveDC (hdc=0x110106ca) returned 1
[0139.705] GetNearestColor (hdc=0x110106ca, color=0xf0f0f0) returned 0xf0f0f0
[0139.705] CreateSolidBrush (color=0xf0f0f0) returned 0xe1008ec
[0139.706] FillRect (hDC=0x110106ca, lprc=0x19e36c, hbr=0xe1008ec) returned 1
[0139.706] DeleteObject (ho=0xe1008ec) returned 1
[0139.706] RestoreDC (hdc=0x110106ca, nSavedDC=-1) returned 1
[0139.707] SetWindowLongW (hWnd=0x802a2, nIndex=-8, dwNewLong=459564) returned 459564
[0139.708] SendMessageW (hWnd=0x7032c, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0
[0139.708] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x80, wParam=0x1, lParam=0x53008f) returned 0x0
[0139.711] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0139.711] GetWindowLongW (hWnd=0x802a2, nIndex=-16) returned 382664704
[0139.711] GetWindowTextLengthW (hWnd=0x802a2) returned 7
[0139.711] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0139.711] GetSystemMetrics (nIndex=42) returned 0
[0139.711] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19ed4c, nMaxCount=8 | out: lpString="notepad") returned 7
[0139.711] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19ed4c) returned 0x7
[0139.712] GetWindowTextLengthW (hWnd=0x802a2) returned 7
[0139.712] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0139.712] GetSystemMetrics (nIndex=42) returned 0
[0139.712] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19ed4c, nMaxCount=8 | out: lpString="notepad") returned 7
[0139.712] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19ed4c) returned 0x7
[0139.712] GetWindowLongW (hWnd=0x802a2, nIndex=-16) returned 382664704
[0139.712] GetWindowLongW (hWnd=0x802a2, nIndex=-20) returned 590080
[0139.712] SetWindowLongW (hWnd=0x802a2, nIndex=-16, dwNewLong=315555840) returned 382664704
[0139.712] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x7c, wParam=0xfffffff0, lParam=0x19eda4) returned 0x0
[0139.713] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x7d, wParam=0xfffffff0, lParam=0x19eda4) returned 0x0
[0139.714] SetWindowLongW (hWnd=0x802a2, nIndex=-20, dwNewLong=589824) returned 590080
[0139.715] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x7c, wParam=0xffffffec, lParam=0x19eda4) returned 0x0
[0139.715] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x7d, wParam=0xffffffec, lParam=0x19eda4) returned 0x0
[0139.733] SetWindowPos (hWnd=0x802a2, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1
[0139.733] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x46, wParam=0x0, lParam=0x19edc4) returned 0x0
[0139.734] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x83, wParam=0x1, lParam=0x19ed9c) returned 0x0
[0139.737] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0139.741] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19eb50 | out: lpwndpl=0x19eb50) returned 1
[0139.741] GetClientRect (in: hWnd=0x802a2, lpRect=0x19eafc | out: lpRect=0x19eafc) returned 1
[0139.741] GetWindowTextLengthW (hWnd=0x802a2) returned 7
[0139.741] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0139.741] GetSystemMetrics (nIndex=42) returned 0
[0139.741] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e9c4, nMaxCount=8 | out: lpString="notepad") returned 7
[0139.741] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e9c4) returned 0x7
[0139.741] GetClientRect (in: hWnd=0x802a2, lpRect=0x19ea04 | out: lpRect=0x19ea04) returned 1
[0139.741] GetCurrentObject (hdc=0x110106ca, type=0x1) returned 0x1b00017
[0139.741] GetCurrentObject (hdc=0x110106ca, type=0x2) returned 0x1900010
[0139.741] GetCurrentObject (hdc=0x110106ca, type=0x7) returned 0x360506d2
[0139.742] GetCurrentObject (hdc=0x110106ca, type=0x6) returned 0x18a0048
[0139.742] SaveDC (hdc=0x110106ca) returned 1
[0139.742] GetNearestColor (hdc=0x110106ca, color=0xf0f0f0) returned 0xf0f0f0
[0139.742] CreateSolidBrush (color=0xf0f0f0) returned 0xf1008ec
[0139.742] FillRect (hDC=0x110106ca, lprc=0x19e8a4, hbr=0xf1008ec) returned 1
[0139.742] DeleteObject (ho=0xf1008ec) returned 1
[0139.742] RestoreDC (hdc=0x110106ca, nSavedDC=-1) returned 1
[0139.743] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19eb34 | out: lpwndpl=0x19eb34) returned 1
[0139.743] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x47, wParam=0x0, lParam=0x19edc4) returned 0x0
[0139.743] GetClientRect (in: hWnd=0x802a2, lpRect=0x19eae4 | out: lpRect=0x19eae4) returned 1
[0139.743] GetWindowRect (in: hWnd=0x802a2, lpRect=0x19eae4 | out: lpRect=0x19eae4) returned 1
[0139.745] RedrawWindow (hWnd=0x802a2, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0139.745] GetSystemMenu (hWnd=0x802a2, bRevert=0) returned 0x90139
[0139.745] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19edf8 | out: lpwndpl=0x19edf8) returned 1
[0139.745] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf020, uEnable=0x0) returned 0
[0139.745] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf030, uEnable=0x0) returned 0
[0139.745] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf060, uEnable=0x0) returned 0
[0139.745] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf120, uEnable=0x1) returned 1
[0139.745] EnableMenuItem (hMenu=0x90139, uIDEnableItem=0xf000, uEnable=0x0) returned 0
[0139.746] SetWindowLongW (hWnd=0xc01e4, nIndex=-8, dwNewLong=524962) returned 262656
[0140.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1
[0140.236] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d
[0140.238] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpFilePart=0x0) returned 0x1e
[0140.240] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf18745d5, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0xf18745d5, ftLastWriteTime.dwHighDateTime=0x1d8589f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x68fde0
[0140.244] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf18745d5, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0xf18745d5, ftLastWriteTime.dwHighDateTime=0x1d8589f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0140.245] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75469f50, ftCreationTime.dwHighDateTime=0x1d828d4, ftLastAccessTime.dwLowDateTime=0x70383f70, ftLastAccessTime.dwHighDateTime=0x1d82995, ftLastWriteTime.dwLowDateTime=0x70383f70, ftLastWriteTime.dwHighDateTime=0x1d82995, nFileSizeHigh=0x0, nFileSizeLow=0x723e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2BCq2zisH1tDLrOOSW.csv", cAlternateFileName="2BCQ2Z~1.CSV")) returned 1
[0140.246] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1027c60, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0xd8eca900, ftLastAccessTime.dwHighDateTime=0x1d82a23, ftLastWriteTime.dwLowDateTime=0xd8eca900, ftLastWriteTime.dwHighDateTime=0x1d82a23, nFileSizeHigh=0x0, nFileSizeLow=0x2103, dwReserved0=0x0, dwReserved1=0x0, cFileName="438nbzlkP EaX9m.flv", cAlternateFileName="438NBZ~1.FLV")) returned 1
[0140.246] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf64e39c0, ftCreationTime.dwHighDateTime=0x1d82576, ftLastAccessTime.dwLowDateTime=0x98e694d0, ftLastAccessTime.dwHighDateTime=0x1d827e2, ftLastWriteTime.dwLowDateTime=0x98e694d0, ftLastWriteTime.dwHighDateTime=0x1d827e2, nFileSizeHigh=0x0, nFileSizeLow=0x1697, dwReserved0=0x0, dwReserved1=0x0, cFileName="80TvEOvTr5nvyl.swf", cAlternateFileName="80TVEO~1.SWF")) returned 1
[0140.246] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109394f0, ftCreationTime.dwHighDateTime=0x1d82631, ftLastAccessTime.dwLowDateTime=0x42022320, ftLastAccessTime.dwHighDateTime=0x1d827e5, ftLastWriteTime.dwLowDateTime=0x42022320, ftLastWriteTime.dwHighDateTime=0x1d827e5, nFileSizeHigh=0x0, nFileSizeLow=0x14bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="87ZhhWQhavO-.mkv", cAlternateFileName="87ZHHW~1.MKV")) returned 1
[0140.246] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8fuFu", cAlternateFileName="")) returned 1
[0140.246] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c49570, ftCreationTime.dwHighDateTime=0x1d825f7, ftLastAccessTime.dwLowDateTime=0xe3e47740, ftLastAccessTime.dwHighDateTime=0x1d829e5, ftLastWriteTime.dwLowDateTime=0xe3e47740, ftLastWriteTime.dwHighDateTime=0x1d829e5, nFileSizeHigh=0x0, nFileSizeLow=0x7069, dwReserved0=0x0, dwReserved1=0x0, cFileName="8H3cx4bVP1NLZr8fhYb.swf", cAlternateFileName="8H3CX4~1.SWF")) returned 1
[0140.247] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6165860, ftCreationTime.dwHighDateTime=0x1d81d21, ftLastAccessTime.dwLowDateTime=0x364c0e10, ftLastAccessTime.dwHighDateTime=0x1d8269b, ftLastWriteTime.dwLowDateTime=0x364c0e10, ftLastWriteTime.dwHighDateTime=0x1d8269b, nFileSizeHigh=0x0, nFileSizeLow=0xb505, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6CiMczxY2F3JXYRzK.png", cAlternateFileName="A6CIMC~1.PNG")) returned 1
[0140.247] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed61e80, ftCreationTime.dwHighDateTime=0x1d8280e, ftLastAccessTime.dwLowDateTime=0xb7188b20, ftLastAccessTime.dwHighDateTime=0x1d828aa, ftLastWriteTime.dwLowDateTime=0xb7188b20, ftLastWriteTime.dwHighDateTime=0x1d828aa, nFileSizeHigh=0x0, nFileSizeLow=0x18629, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9li7.bmp", cAlternateFileName="")) returned 1
[0140.247] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4b4370, ftCreationTime.dwHighDateTime=0x1d829e2, ftLastAccessTime.dwLowDateTime=0xe158e200, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0xe158e200, ftLastWriteTime.dwHighDateTime=0x1d829f3, nFileSizeHigh=0x0, nFileSizeLow=0xe6d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="aA9p.png", cAlternateFileName="")) returned 1
[0140.248] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e10200, ftCreationTime.dwHighDateTime=0x1d8589f, ftLastAccessTime.dwLowDateTime=0xc3799880, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0x227fe300, ftLastWriteTime.dwHighDateTime=0x1d85889, nFileSizeHigh=0x0, nFileSizeLow=0x39a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe", cAlternateFileName="BABA76~1.EXE")) returned 1
[0140.248] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd230, ftCreationTime.dwHighDateTime=0x1d81db1, ftLastAccessTime.dwLowDateTime=0xa0725a70, ftLastAccessTime.dwHighDateTime=0x1d825a5, ftLastWriteTime.dwLowDateTime=0xa0725a70, ftLastWriteTime.dwHighDateTime=0x1d825a5, nFileSizeHigh=0x0, nFileSizeLow=0x16eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7vniJGTZ.mp3", cAlternateFileName="C7VNIJ~1.MP3")) returned 1
[0140.248] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794ca3e0, ftCreationTime.dwHighDateTime=0x1d829a8, ftLastAccessTime.dwLowDateTime=0x1b90c270, ftLastAccessTime.dwHighDateTime=0x1d829b9, ftLastWriteTime.dwLowDateTime=0x1b90c270, ftLastWriteTime.dwHighDateTime=0x1d829b9, nFileSizeHigh=0x0, nFileSizeLow=0x12ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="CO1f.m4a", cAlternateFileName="")) returned 1
[0140.248] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0140.249] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b4a0080, ftCreationTime.dwHighDateTime=0x1d82261, ftLastAccessTime.dwLowDateTime=0x3dae6420, ftLastAccessTime.dwHighDateTime=0x1d8280b, ftLastWriteTime.dwLowDateTime=0x3dae6420, ftLastWriteTime.dwHighDateTime=0x1d8280b, nFileSizeHigh=0x0, nFileSizeLow=0x8ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dUAMxP2Q.m4a", cAlternateFileName="")) returned 1
[0140.249] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15588f60, ftCreationTime.dwHighDateTime=0x1d82526, ftLastAccessTime.dwLowDateTime=0x1fa82e70, ftLastAccessTime.dwHighDateTime=0x1d826a3, ftLastWriteTime.dwLowDateTime=0x1fa82e70, ftLastWriteTime.dwHighDateTime=0x1d826a3, nFileSizeHigh=0x0, nFileSizeLow=0x309f, dwReserved0=0x0, dwReserved1=0x0, cFileName="fch1HElCA7Cv3KXW.png", cAlternateFileName="FCH1HE~1.PNG")) returned 1
[0140.249] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d1f050, ftCreationTime.dwHighDateTime=0x1d82804, ftLastAccessTime.dwLowDateTime=0xb74dc940, ftLastAccessTime.dwHighDateTime=0x1d829d9, ftLastWriteTime.dwLowDateTime=0xb74dc940, ftLastWriteTime.dwHighDateTime=0x1d829d9, nFileSizeHigh=0x0, nFileSizeLow=0x4beb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GleaUaOZW Lth.avi", cAlternateFileName="GLEAUA~1.AVI")) returned 1
[0140.250] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6581ff0, ftCreationTime.dwHighDateTime=0x1d82648, ftLastAccessTime.dwLowDateTime=0xa4079e40, ftLastAccessTime.dwHighDateTime=0x1d8285a, ftLastWriteTime.dwLowDateTime=0xa4079e40, ftLastWriteTime.dwHighDateTime=0x1d8285a, nFileSizeHigh=0x0, nFileSizeLow=0x17903, dwReserved0=0x0, dwReserved1=0x0, cFileName="gPnVA1epmh.png", cAlternateFileName="GPNVA1~1.PNG")) returned 1
[0140.250] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f48d9a0, ftCreationTime.dwHighDateTime=0x1d8268b, ftLastAccessTime.dwLowDateTime=0xaa772510, ftLastAccessTime.dwHighDateTime=0x1d827f7, ftLastWriteTime.dwLowDateTime=0xaa772510, ftLastWriteTime.dwHighDateTime=0x1d827f7, nFileSizeHigh=0x0, nFileSizeLow=0xe419, dwReserved0=0x0, dwReserved1=0x0, cFileName="jKEImg2LCcB.png", cAlternateFileName="JKEIMG~1.PNG")) returned 1
[0140.250] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c171950, ftCreationTime.dwHighDateTime=0x1d81c87, ftLastAccessTime.dwLowDateTime=0xafb147c0, ftLastAccessTime.dwHighDateTime=0x1d826a5, ftLastWriteTime.dwLowDateTime=0xafb147c0, ftLastWriteTime.dwHighDateTime=0x1d826a5, nFileSizeHigh=0x0, nFileSizeLow=0x7869, dwReserved0=0x0, dwReserved1=0x0, cFileName="kFzsu2uze8.jpg", cAlternateFileName="KFZSU2~1.JPG")) returned 1
[0140.251] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460e43b0, ftCreationTime.dwHighDateTime=0x1d8228e, ftLastAccessTime.dwLowDateTime=0x76e4e150, ftLastAccessTime.dwHighDateTime=0x1d82a19, ftLastWriteTime.dwLowDateTime=0x76e4e150, ftLastWriteTime.dwHighDateTime=0x1d82a19, nFileSizeHigh=0x0, nFileSizeLow=0x8727, dwReserved0=0x0, dwReserved1=0x0, cFileName="km0vfS3iiuegbE.mp3", cAlternateFileName="KM0VFS~1.MP3")) returned 1
[0140.251] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddc3eb0, ftCreationTime.dwHighDateTime=0x1d82731, ftLastAccessTime.dwLowDateTime=0xf7465ec0, ftLastAccessTime.dwHighDateTime=0x1d827ce, ftLastWriteTime.dwLowDateTime=0xf7465ec0, ftLastWriteTime.dwHighDateTime=0x1d827ce, nFileSizeHigh=0x0, nFileSizeLow=0x13527, dwReserved0=0x0, dwReserved1=0x0, cFileName="lZ59hc.xls", cAlternateFileName="")) returned 1
[0140.251] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc235a10, ftCreationTime.dwHighDateTime=0x1d829c1, ftLastAccessTime.dwLowDateTime=0x4622c960, ftLastAccessTime.dwHighDateTime=0x1d82a1e, ftLastWriteTime.dwLowDateTime=0x4622c960, ftLastWriteTime.dwHighDateTime=0x1d82a1e, nFileSizeHigh=0x0, nFileSizeLow=0xacae, dwReserved0=0x0, dwReserved1=0x0, cFileName="nfhA716ggQO1lHuA.mp3", cAlternateFileName="NFHA71~1.MP3")) returned 1
[0140.251] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc94b9910, ftCreationTime.dwHighDateTime=0x1d824f2, ftLastAccessTime.dwLowDateTime=0xfa5db2b0, ftLastAccessTime.dwHighDateTime=0x1d82522, ftLastWriteTime.dwLowDateTime=0xfa5db2b0, ftLastWriteTime.dwHighDateTime=0x1d82522, nFileSizeHigh=0x0, nFileSizeLow=0x7f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="nI-Ynzgfo-bdwG.ods", cAlternateFileName="NI-YNZ~1.ODS")) returned 1
[0140.252] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359d5dc0, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0xb1b2c3e0, ftLastAccessTime.dwHighDateTime=0x1d828a4, ftLastWriteTime.dwLowDateTime=0xb1b2c3e0, ftLastWriteTime.dwHighDateTime=0x1d828a4, nFileSizeHigh=0x0, nFileSizeLow=0x45ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="NRNIxsblK328jZ.m4a", cAlternateFileName="NRNIXS~1.M4A")) returned 1
[0140.252] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda4aa0, ftCreationTime.dwHighDateTime=0x1d8246b, ftLastAccessTime.dwLowDateTime=0xada4e600, ftLastAccessTime.dwHighDateTime=0x1d82531, ftLastWriteTime.dwLowDateTime=0xada4e600, ftLastWriteTime.dwHighDateTime=0x1d82531, nFileSizeHigh=0x0, nFileSizeLow=0xc844, dwReserved0=0x0, dwReserved1=0x0, cFileName="qIiBDhQ7QB7UnHl2EQ1.gif", cAlternateFileName="QIIBDH~1.GIF")) returned 1
[0140.252] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20339d60, ftCreationTime.dwHighDateTime=0x1d81d12, ftLastAccessTime.dwLowDateTime=0x245234d0, ftLastAccessTime.dwHighDateTime=0x1d8276f, ftLastWriteTime.dwLowDateTime=0x245234d0, ftLastWriteTime.dwHighDateTime=0x1d8276f, nFileSizeHigh=0x0, nFileSizeLow=0x128b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="qxMCjsWp9C.swf", cAlternateFileName="QXMCJS~1.SWF")) returned 1
[0140.252] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8fb6f0, ftCreationTime.dwHighDateTime=0x1d827a5, ftLastAccessTime.dwLowDateTime=0x823cc880, ftLastAccessTime.dwHighDateTime=0x1d8283c, ftLastWriteTime.dwLowDateTime=0x823cc880, ftLastWriteTime.dwHighDateTime=0x1d8283c, nFileSizeHigh=0x0, nFileSizeLow=0x13019, dwReserved0=0x0, dwReserved1=0x0, cFileName="rfEzxhy.flv", cAlternateFileName="")) returned 1
[0140.253] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63efb400, ftCreationTime.dwHighDateTime=0x1d8206c, ftLastAccessTime.dwLowDateTime=0xf8c06ee0, ftLastAccessTime.dwHighDateTime=0x1d822dc, ftLastWriteTime.dwLowDateTime=0xf8c06ee0, ftLastWriteTime.dwHighDateTime=0x1d822dc, nFileSizeHigh=0x0, nFileSizeLow=0x1836c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S byA0FI2i1A.jpg", cAlternateFileName="SBYA0F~1.JPG")) returned 1
[0140.253] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc43afb0, ftCreationTime.dwHighDateTime=0x1d8210f, ftLastAccessTime.dwLowDateTime=0xdfa50190, ftLastAccessTime.dwHighDateTime=0x1d822ce, ftLastWriteTime.dwLowDateTime=0xdfa50190, ftLastWriteTime.dwHighDateTime=0x1d822ce, nFileSizeHigh=0x0, nFileSizeLow=0x1141e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWBY_7mpYkRP6I.avi", cAlternateFileName="TWBY_7~1.AVI")) returned 1
[0140.253] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b82ba0, ftCreationTime.dwHighDateTime=0x1d82888, ftLastAccessTime.dwLowDateTime=0x8e980cb0, ftLastAccessTime.dwHighDateTime=0x1d829d2, ftLastWriteTime.dwLowDateTime=0x8e980cb0, ftLastWriteTime.dwHighDateTime=0x1d829d2, nFileSizeHigh=0x0, nFileSizeLow=0x93e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UUZnNLpt1yyHK2REqD8.xls", cAlternateFileName="UUZNNL~1.XLS")) returned 1
[0140.253] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b642cf0, ftCreationTime.dwHighDateTime=0x1d8296c, ftLastAccessTime.dwLowDateTime=0xdab17dc0, ftLastAccessTime.dwHighDateTime=0x1d82a13, ftLastWriteTime.dwLowDateTime=0xdab17dc0, ftLastWriteTime.dwHighDateTime=0x1d82a13, nFileSizeHigh=0x0, nFileSizeLow=0x252c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WUHo.xls", cAlternateFileName="")) returned 1
[0140.254] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f94f300, ftCreationTime.dwHighDateTime=0x1d8226e, ftLastAccessTime.dwLowDateTime=0x3c69ff20, ftLastAccessTime.dwHighDateTime=0x1d8249b, ftLastWriteTime.dwLowDateTime=0x3c69ff20, ftLastWriteTime.dwHighDateTime=0x1d8249b, nFileSizeHigh=0x0, nFileSizeLow=0x40d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y9Yc7GFT5o-.flv", cAlternateFileName="Y9YC7G~1.FLV")) returned 1
[0140.254] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef413730, ftCreationTime.dwHighDateTime=0x1d81cd5, ftLastAccessTime.dwLowDateTime=0x4d5bae90, ftLastAccessTime.dwHighDateTime=0x1d81f92, ftLastWriteTime.dwLowDateTime=0x4d5bae90, ftLastWriteTime.dwHighDateTime=0x1d81f92, nFileSizeHigh=0x0, nFileSizeLow=0xa5e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yc_dgQq9.swf", cAlternateFileName="")) returned 1
[0140.254] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceefb870, ftCreationTime.dwHighDateTime=0x1d82893, ftLastAccessTime.dwLowDateTime=0xc13a12d0, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0xc13a12d0, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0x55d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZuEu4h9uDeB.mkv", cAlternateFileName="ZUEU4H~1.MKV")) returned 1
[0140.254] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb29820, ftCreationTime.dwHighDateTime=0x1d826f7, ftLastAccessTime.dwLowDateTime=0x800b3010, ftLastAccessTime.dwHighDateTime=0x1d8297c, ftLastWriteTime.dwLowDateTime=0x800b3010, ftLastWriteTime.dwHighDateTime=0x1d8297c, nFileSizeHigh=0x0, nFileSizeLow=0x177e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="_z9 qmOEfbbR2Ho.png", cAlternateFileName="_Z9QMO~1.PNG")) returned 1
[0140.255] FindNextFileW (in: hFindFile=0x68fde0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0140.255] FindClose (in: hFindFile=0x68fde0 | out: hFindFile=0x68fde0) returned 1
[0140.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1
[0140.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1
[0140.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1
[0140.256] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d
[0140.256] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpFilePart=0x0) returned 0x1e
[0140.256] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf18745d5, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0xf18745d5, ftLastWriteTime.dwHighDateTime=0x1d8589f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6900e0
[0140.257] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf18745d5, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0xf18745d5, ftLastWriteTime.dwHighDateTime=0x1d8589f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0140.258] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75469f50, ftCreationTime.dwHighDateTime=0x1d828d4, ftLastAccessTime.dwLowDateTime=0x70383f70, ftLastAccessTime.dwHighDateTime=0x1d82995, ftLastWriteTime.dwLowDateTime=0x70383f70, ftLastWriteTime.dwHighDateTime=0x1d82995, nFileSizeHigh=0x0, nFileSizeLow=0x723e, dwReserved0=0x0, dwReserved1=0x0, cFileName="2BCq2zisH1tDLrOOSW.csv", cAlternateFileName="2BCQ2Z~1.CSV")) returned 1
[0140.263] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1027c60, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0xd8eca900, ftLastAccessTime.dwHighDateTime=0x1d82a23, ftLastWriteTime.dwLowDateTime=0xd8eca900, ftLastWriteTime.dwHighDateTime=0x1d82a23, nFileSizeHigh=0x0, nFileSizeLow=0x2103, dwReserved0=0x0, dwReserved1=0x0, cFileName="438nbzlkP EaX9m.flv", cAlternateFileName="438NBZ~1.FLV")) returned 1
[0140.264] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf64e39c0, ftCreationTime.dwHighDateTime=0x1d82576, ftLastAccessTime.dwLowDateTime=0x98e694d0, ftLastAccessTime.dwHighDateTime=0x1d827e2, ftLastWriteTime.dwLowDateTime=0x98e694d0, ftLastWriteTime.dwHighDateTime=0x1d827e2, nFileSizeHigh=0x0, nFileSizeLow=0x1697, dwReserved0=0x0, dwReserved1=0x0, cFileName="80TvEOvTr5nvyl.swf", cAlternateFileName="80TVEO~1.SWF")) returned 1
[0140.264] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109394f0, ftCreationTime.dwHighDateTime=0x1d82631, ftLastAccessTime.dwLowDateTime=0x42022320, ftLastAccessTime.dwHighDateTime=0x1d827e5, ftLastWriteTime.dwLowDateTime=0x42022320, ftLastWriteTime.dwHighDateTime=0x1d827e5, nFileSizeHigh=0x0, nFileSizeLow=0x14bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="87ZhhWQhavO-.mkv", cAlternateFileName="87ZHHW~1.MKV")) returned 1
[0140.264] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8fuFu", cAlternateFileName="")) returned 1
[0140.264] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c49570, ftCreationTime.dwHighDateTime=0x1d825f7, ftLastAccessTime.dwLowDateTime=0xe3e47740, ftLastAccessTime.dwHighDateTime=0x1d829e5, ftLastWriteTime.dwLowDateTime=0xe3e47740, ftLastWriteTime.dwHighDateTime=0x1d829e5, nFileSizeHigh=0x0, nFileSizeLow=0x7069, dwReserved0=0x0, dwReserved1=0x0, cFileName="8H3cx4bVP1NLZr8fhYb.swf", cAlternateFileName="8H3CX4~1.SWF")) returned 1
[0140.265] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6165860, ftCreationTime.dwHighDateTime=0x1d81d21, ftLastAccessTime.dwLowDateTime=0x364c0e10, ftLastAccessTime.dwHighDateTime=0x1d8269b, ftLastWriteTime.dwLowDateTime=0x364c0e10, ftLastWriteTime.dwHighDateTime=0x1d8269b, nFileSizeHigh=0x0, nFileSizeLow=0xb505, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6CiMczxY2F3JXYRzK.png", cAlternateFileName="A6CIMC~1.PNG")) returned 1
[0140.265] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed61e80, ftCreationTime.dwHighDateTime=0x1d8280e, ftLastAccessTime.dwLowDateTime=0xb7188b20, ftLastAccessTime.dwHighDateTime=0x1d828aa, ftLastWriteTime.dwLowDateTime=0xb7188b20, ftLastWriteTime.dwHighDateTime=0x1d828aa, nFileSizeHigh=0x0, nFileSizeLow=0x18629, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9li7.bmp", cAlternateFileName="")) returned 1
[0140.266] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4b4370, ftCreationTime.dwHighDateTime=0x1d829e2, ftLastAccessTime.dwLowDateTime=0xe158e200, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0xe158e200, ftLastWriteTime.dwHighDateTime=0x1d829f3, nFileSizeHigh=0x0, nFileSizeLow=0xe6d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="aA9p.png", cAlternateFileName="")) returned 1
[0140.266] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e10200, ftCreationTime.dwHighDateTime=0x1d8589f, ftLastAccessTime.dwLowDateTime=0xc3799880, ftLastAccessTime.dwHighDateTime=0x1d8589f, ftLastWriteTime.dwLowDateTime=0x227fe300, ftLastWriteTime.dwHighDateTime=0x1d85889, nFileSizeHigh=0x0, nFileSizeLow=0x39a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="baba76d578be903c9d78e3d6417636ba6a8069cafe9ccccdfce2bc19b43fc299.exe", cAlternateFileName="BABA76~1.EXE")) returned 1
[0140.266] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd230, ftCreationTime.dwHighDateTime=0x1d81db1, ftLastAccessTime.dwLowDateTime=0xa0725a70, ftLastAccessTime.dwHighDateTime=0x1d825a5, ftLastWriteTime.dwLowDateTime=0xa0725a70, ftLastWriteTime.dwHighDateTime=0x1d825a5, nFileSizeHigh=0x0, nFileSizeLow=0x16eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C7vniJGTZ.mp3", cAlternateFileName="C7VNIJ~1.MP3")) returned 1
[0140.267] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794ca3e0, ftCreationTime.dwHighDateTime=0x1d829a8, ftLastAccessTime.dwLowDateTime=0x1b90c270, ftLastAccessTime.dwHighDateTime=0x1d829b9, ftLastWriteTime.dwLowDateTime=0x1b90c270, ftLastWriteTime.dwHighDateTime=0x1d829b9, nFileSizeHigh=0x0, nFileSizeLow=0x12ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="CO1f.m4a", cAlternateFileName="")) returned 1
[0140.267] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0140.267] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b4a0080, ftCreationTime.dwHighDateTime=0x1d82261, ftLastAccessTime.dwLowDateTime=0x3dae6420, ftLastAccessTime.dwHighDateTime=0x1d8280b, ftLastWriteTime.dwLowDateTime=0x3dae6420, ftLastWriteTime.dwHighDateTime=0x1d8280b, nFileSizeHigh=0x0, nFileSizeLow=0x8ed3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dUAMxP2Q.m4a", cAlternateFileName="")) returned 1
[0140.268] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15588f60, ftCreationTime.dwHighDateTime=0x1d82526, ftLastAccessTime.dwLowDateTime=0x1fa82e70, ftLastAccessTime.dwHighDateTime=0x1d826a3, ftLastWriteTime.dwLowDateTime=0x1fa82e70, ftLastWriteTime.dwHighDateTime=0x1d826a3, nFileSizeHigh=0x0, nFileSizeLow=0x309f, dwReserved0=0x0, dwReserved1=0x0, cFileName="fch1HElCA7Cv3KXW.png", cAlternateFileName="FCH1HE~1.PNG")) returned 1
[0140.268] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d1f050, ftCreationTime.dwHighDateTime=0x1d82804, ftLastAccessTime.dwLowDateTime=0xb74dc940, ftLastAccessTime.dwHighDateTime=0x1d829d9, ftLastWriteTime.dwLowDateTime=0xb74dc940, ftLastWriteTime.dwHighDateTime=0x1d829d9, nFileSizeHigh=0x0, nFileSizeLow=0x4beb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GleaUaOZW Lth.avi", cAlternateFileName="GLEAUA~1.AVI")) returned 1
[0140.269] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6581ff0, ftCreationTime.dwHighDateTime=0x1d82648, ftLastAccessTime.dwLowDateTime=0xa4079e40, ftLastAccessTime.dwHighDateTime=0x1d8285a, ftLastWriteTime.dwLowDateTime=0xa4079e40, ftLastWriteTime.dwHighDateTime=0x1d8285a, nFileSizeHigh=0x0, nFileSizeLow=0x17903, dwReserved0=0x0, dwReserved1=0x0, cFileName="gPnVA1epmh.png", cAlternateFileName="GPNVA1~1.PNG")) returned 1
[0140.269] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f48d9a0, ftCreationTime.dwHighDateTime=0x1d8268b, ftLastAccessTime.dwLowDateTime=0xaa772510, ftLastAccessTime.dwHighDateTime=0x1d827f7, ftLastWriteTime.dwLowDateTime=0xaa772510, ftLastWriteTime.dwHighDateTime=0x1d827f7, nFileSizeHigh=0x0, nFileSizeLow=0xe419, dwReserved0=0x0, dwReserved1=0x0, cFileName="jKEImg2LCcB.png", cAlternateFileName="JKEIMG~1.PNG")) returned 1
[0140.269] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c171950, ftCreationTime.dwHighDateTime=0x1d81c87, ftLastAccessTime.dwLowDateTime=0xafb147c0, ftLastAccessTime.dwHighDateTime=0x1d826a5, ftLastWriteTime.dwLowDateTime=0xafb147c0, ftLastWriteTime.dwHighDateTime=0x1d826a5, nFileSizeHigh=0x0, nFileSizeLow=0x7869, dwReserved0=0x0, dwReserved1=0x0, cFileName="kFzsu2uze8.jpg", cAlternateFileName="KFZSU2~1.JPG")) returned 1
[0140.270] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460e43b0, ftCreationTime.dwHighDateTime=0x1d8228e, ftLastAccessTime.dwLowDateTime=0x76e4e150, ftLastAccessTime.dwHighDateTime=0x1d82a19, ftLastWriteTime.dwLowDateTime=0x76e4e150, ftLastWriteTime.dwHighDateTime=0x1d82a19, nFileSizeHigh=0x0, nFileSizeLow=0x8727, dwReserved0=0x0, dwReserved1=0x0, cFileName="km0vfS3iiuegbE.mp3", cAlternateFileName="KM0VFS~1.MP3")) returned 1
[0140.270] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddc3eb0, ftCreationTime.dwHighDateTime=0x1d82731, ftLastAccessTime.dwLowDateTime=0xf7465ec0, ftLastAccessTime.dwHighDateTime=0x1d827ce, ftLastWriteTime.dwLowDateTime=0xf7465ec0, ftLastWriteTime.dwHighDateTime=0x1d827ce, nFileSizeHigh=0x0, nFileSizeLow=0x13527, dwReserved0=0x0, dwReserved1=0x0, cFileName="lZ59hc.xls", cAlternateFileName="")) returned 1
[0140.270] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc235a10, ftCreationTime.dwHighDateTime=0x1d829c1, ftLastAccessTime.dwLowDateTime=0x4622c960, ftLastAccessTime.dwHighDateTime=0x1d82a1e, ftLastWriteTime.dwLowDateTime=0x4622c960, ftLastWriteTime.dwHighDateTime=0x1d82a1e, nFileSizeHigh=0x0, nFileSizeLow=0xacae, dwReserved0=0x0, dwReserved1=0x0, cFileName="nfhA716ggQO1lHuA.mp3", cAlternateFileName="NFHA71~1.MP3")) returned 1
[0140.271] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc94b9910, ftCreationTime.dwHighDateTime=0x1d824f2, ftLastAccessTime.dwLowDateTime=0xfa5db2b0, ftLastAccessTime.dwHighDateTime=0x1d82522, ftLastWriteTime.dwLowDateTime=0xfa5db2b0, ftLastWriteTime.dwHighDateTime=0x1d82522, nFileSizeHigh=0x0, nFileSizeLow=0x7f4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="nI-Ynzgfo-bdwG.ods", cAlternateFileName="NI-YNZ~1.ODS")) returned 1
[0140.271] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x359d5dc0, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0xb1b2c3e0, ftLastAccessTime.dwHighDateTime=0x1d828a4, ftLastWriteTime.dwLowDateTime=0xb1b2c3e0, ftLastWriteTime.dwHighDateTime=0x1d828a4, nFileSizeHigh=0x0, nFileSizeLow=0x45ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="NRNIxsblK328jZ.m4a", cAlternateFileName="NRNIXS~1.M4A")) returned 1
[0140.271] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdda4aa0, ftCreationTime.dwHighDateTime=0x1d8246b, ftLastAccessTime.dwLowDateTime=0xada4e600, ftLastAccessTime.dwHighDateTime=0x1d82531, ftLastWriteTime.dwLowDateTime=0xada4e600, ftLastWriteTime.dwHighDateTime=0x1d82531, nFileSizeHigh=0x0, nFileSizeLow=0xc844, dwReserved0=0x0, dwReserved1=0x0, cFileName="qIiBDhQ7QB7UnHl2EQ1.gif", cAlternateFileName="QIIBDH~1.GIF")) returned 1
[0140.272] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20339d60, ftCreationTime.dwHighDateTime=0x1d81d12, ftLastAccessTime.dwLowDateTime=0x245234d0, ftLastAccessTime.dwHighDateTime=0x1d8276f, ftLastWriteTime.dwLowDateTime=0x245234d0, ftLastWriteTime.dwHighDateTime=0x1d8276f, nFileSizeHigh=0x0, nFileSizeLow=0x128b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="qxMCjsWp9C.swf", cAlternateFileName="QXMCJS~1.SWF")) returned 1
[0140.273] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8fb6f0, ftCreationTime.dwHighDateTime=0x1d827a5, ftLastAccessTime.dwLowDateTime=0x823cc880, ftLastAccessTime.dwHighDateTime=0x1d8283c, ftLastWriteTime.dwLowDateTime=0x823cc880, ftLastWriteTime.dwHighDateTime=0x1d8283c, nFileSizeHigh=0x0, nFileSizeLow=0x13019, dwReserved0=0x0, dwReserved1=0x0, cFileName="rfEzxhy.flv", cAlternateFileName="")) returned 1
[0140.273] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63efb400, ftCreationTime.dwHighDateTime=0x1d8206c, ftLastAccessTime.dwLowDateTime=0xf8c06ee0, ftLastAccessTime.dwHighDateTime=0x1d822dc, ftLastWriteTime.dwLowDateTime=0xf8c06ee0, ftLastWriteTime.dwHighDateTime=0x1d822dc, nFileSizeHigh=0x0, nFileSizeLow=0x1836c, dwReserved0=0x0, dwReserved1=0x0, cFileName="S byA0FI2i1A.jpg", cAlternateFileName="SBYA0F~1.JPG")) returned 1
[0140.273] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc43afb0, ftCreationTime.dwHighDateTime=0x1d8210f, ftLastAccessTime.dwLowDateTime=0xdfa50190, ftLastAccessTime.dwHighDateTime=0x1d822ce, ftLastWriteTime.dwLowDateTime=0xdfa50190, ftLastWriteTime.dwHighDateTime=0x1d822ce, nFileSizeHigh=0x0, nFileSizeLow=0x1141e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWBY_7mpYkRP6I.avi", cAlternateFileName="TWBY_7~1.AVI")) returned 1
[0140.274] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b82ba0, ftCreationTime.dwHighDateTime=0x1d82888, ftLastAccessTime.dwLowDateTime=0x8e980cb0, ftLastAccessTime.dwHighDateTime=0x1d829d2, ftLastWriteTime.dwLowDateTime=0x8e980cb0, ftLastWriteTime.dwHighDateTime=0x1d829d2, nFileSizeHigh=0x0, nFileSizeLow=0x93e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UUZnNLpt1yyHK2REqD8.xls", cAlternateFileName="UUZNNL~1.XLS")) returned 1
[0140.274] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b642cf0, ftCreationTime.dwHighDateTime=0x1d8296c, ftLastAccessTime.dwLowDateTime=0xdab17dc0, ftLastAccessTime.dwHighDateTime=0x1d82a13, ftLastWriteTime.dwLowDateTime=0xdab17dc0, ftLastWriteTime.dwHighDateTime=0x1d82a13, nFileSizeHigh=0x0, nFileSizeLow=0x252c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WUHo.xls", cAlternateFileName="")) returned 1
[0140.275] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f94f300, ftCreationTime.dwHighDateTime=0x1d8226e, ftLastAccessTime.dwLowDateTime=0x3c69ff20, ftLastAccessTime.dwHighDateTime=0x1d8249b, ftLastWriteTime.dwLowDateTime=0x3c69ff20, ftLastWriteTime.dwHighDateTime=0x1d8249b, nFileSizeHigh=0x0, nFileSizeLow=0x40d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y9Yc7GFT5o-.flv", cAlternateFileName="Y9YC7G~1.FLV")) returned 1
[0140.275] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef413730, ftCreationTime.dwHighDateTime=0x1d81cd5, ftLastAccessTime.dwLowDateTime=0x4d5bae90, ftLastAccessTime.dwHighDateTime=0x1d81f92, ftLastWriteTime.dwLowDateTime=0x4d5bae90, ftLastWriteTime.dwHighDateTime=0x1d81f92, nFileSizeHigh=0x0, nFileSizeLow=0xa5e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yc_dgQq9.swf", cAlternateFileName="")) returned 1
[0140.275] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceefb870, ftCreationTime.dwHighDateTime=0x1d82893, ftLastAccessTime.dwLowDateTime=0xc13a12d0, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0xc13a12d0, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0x55d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZuEu4h9uDeB.mkv", cAlternateFileName="ZUEU4H~1.MKV")) returned 1
[0140.276] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb29820, ftCreationTime.dwHighDateTime=0x1d826f7, ftLastAccessTime.dwLowDateTime=0x800b3010, ftLastAccessTime.dwHighDateTime=0x1d8297c, ftLastWriteTime.dwLowDateTime=0x800b3010, ftLastWriteTime.dwHighDateTime=0x1d8297c, nFileSizeHigh=0x0, nFileSizeLow=0x177e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="_z9 qmOEfbbR2Ho.png", cAlternateFileName="_Z9QMO~1.PNG")) returned 1
[0140.276] FindNextFileW (in: hFindFile=0x6900e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb29820, ftCreationTime.dwHighDateTime=0x1d826f7, ftLastAccessTime.dwLowDateTime=0x800b3010, ftLastAccessTime.dwHighDateTime=0x1d8297c, ftLastWriteTime.dwLowDateTime=0x800b3010, ftLastWriteTime.dwHighDateTime=0x1d8297c, nFileSizeHigh=0x0, nFileSizeLow=0x177e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="_z9 qmOEfbbR2Ho.png", cAlternateFileName="_Z9QMO~1.PNG")) returned 0
[0140.276] FindClose (in: hFindFile=0x6900e0 | out: hFindFile=0x6900e0) returned 1
[0140.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1
[0140.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1
[0140.294] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", lpFilePart=0x0) returned 0x34
[0140.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0140.294] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2bcq2zish1tdlroosw.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2b4
[0140.295] GetFileType (hFile=0x2b4) returned 0x1
[0140.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0140.295] GetFileType (hFile=0x2b4) returned 0x1
[0140.297] GetFileSize (in: hFile=0x2b4, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x723e
[0140.298] ReadFile (in: hFile=0x2b4, lpBuffer=0x21e8d40, nNumberOfBytesToRead=0x723e, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x21e8d40*, lpNumberOfBytesRead=0x19eeb0*=0x723e, lpOverlapped=0x0) returned 1
[0140.300] CloseHandle (hObject=0x2b4) returned 1
[0146.723] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e8b4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43
[0146.724] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e91c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43
[0146.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed7c) returned 1
[0146.724] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19edf8 | out: lpFileInformation=0x19edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1
[0146.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed78) returned 1
[0147.381] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19eb0c | out: pfEnabled=0x19eb0c) returned 0x0
[0147.785] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", lpFilePart=0x0) returned 0x34
[0147.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0147.785] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2bcq2zish1tdlroosw.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0147.788] GetFileType (hFile=0x33c) returned 0x1
[0147.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0147.788] GetFileType (hFile=0x33c) returned 0x1
[0147.789] WriteFile (in: hFile=0x33c, lpBuffer=0x228386c*, nNumberOfBytesToWrite=0x7240, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x228386c*, lpNumberOfBytesWritten=0x19eea0*=0x7240, lpOverlapped=0x0) returned 1
[0147.791] CloseHandle (hObject=0x33c) returned 1
[0147.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv", lpFilePart=0x0) returned 0x34
[0147.793] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv.coom", lpFilePart=0x0) returned 0x39
[0147.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0147.793] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2bcq2zish1tdlroosw.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75469f50, ftCreationTime.dwHighDateTime=0x1d828d4, ftLastAccessTime.dwLowDateTime=0x70383f70, ftLastAccessTime.dwHighDateTime=0x1d82995, ftLastWriteTime.dwLowDateTime=0x1cf043fd, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7240)) returned 1
[0147.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0147.795] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2bcq2zish1tdlroosw.csv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\2BCq2zisH1tDLrOOSW.csv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\2bcq2zish1tdlroosw.csv.coom")) returned 1
[0147.796] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", lpFilePart=0x0) returned 0x31
[0147.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0147.796] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\438nbzlkp eax9m.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0147.796] GetFileType (hFile=0x33c) returned 0x1
[0147.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0147.796] GetFileType (hFile=0x33c) returned 0x1
[0147.797] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x2103
[0147.797] ReadFile (in: hFile=0x33c, lpBuffer=0x228ae58, nNumberOfBytesToRead=0x2103, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x228ae58*, lpNumberOfBytesRead=0x19eeb0*=0x2103, lpOverlapped=0x0) returned 1
[0147.798] CloseHandle (hObject=0x33c) returned 1
[0147.870] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", lpFilePart=0x0) returned 0x31
[0147.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0147.871] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\438nbzlkp eax9m.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0147.872] GetFileType (hFile=0x33c) returned 0x1
[0147.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0147.872] GetFileType (hFile=0x33c) returned 0x1
[0147.872] WriteFile (in: hFile=0x33c, lpBuffer=0x22e216c*, nNumberOfBytesToWrite=0x2110, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22e216c*, lpNumberOfBytesWritten=0x19eea0*=0x2110, lpOverlapped=0x0) returned 1
[0147.874] CloseHandle (hObject=0x33c) returned 1
[0147.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv", lpFilePart=0x0) returned 0x31
[0147.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv.coom", lpFilePart=0x0) returned 0x36
[0147.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0147.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\438nbzlkp eax9m.flv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1027c60, ftCreationTime.dwHighDateTime=0x1d825ba, ftLastAccessTime.dwLowDateTime=0xd8eca900, ftLastAccessTime.dwHighDateTime=0x1d82a23, ftLastWriteTime.dwLowDateTime=0x1cfcc46b, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x2110)) returned 1
[0147.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0147.876] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\438nbzlkp eax9m.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\438nbzlkP EaX9m.flv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\438nbzlkp eax9m.flv.coom")) returned 1
[0147.877] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", lpFilePart=0x0) returned 0x30
[0147.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0147.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80tveovtr5nvyl.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0147.878] GetFileType (hFile=0x33c) returned 0x1
[0147.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0147.878] GetFileType (hFile=0x33c) returned 0x1
[0147.878] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1697
[0147.878] ReadFile (in: hFile=0x33c, lpBuffer=0x22e4608, nNumberOfBytesToRead=0x1697, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22e4608*, lpNumberOfBytesRead=0x19eeb0*=0x1697, lpOverlapped=0x0) returned 1
[0147.879] CloseHandle (hObject=0x33c) returned 1
[0147.926] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", lpFilePart=0x0) returned 0x30
[0147.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0147.926] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80tveovtr5nvyl.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0147.928] GetFileType (hFile=0x33c) returned 0x1
[0147.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0147.928] GetFileType (hFile=0x33c) returned 0x1
[0147.928] WriteFile (in: hFile=0x33c, lpBuffer=0x23384ec*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23384ec*, lpNumberOfBytesWritten=0x19eea0*=0x16a0, lpOverlapped=0x0) returned 1
[0147.930] CloseHandle (hObject=0x33c) returned 1
[0147.938] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf", lpFilePart=0x0) returned 0x30
[0147.938] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf.coom", lpFilePart=0x0) returned 0x35
[0147.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0147.938] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80tveovtr5nvyl.swf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf64e39c0, ftCreationTime.dwHighDateTime=0x1d82576, ftLastAccessTime.dwLowDateTime=0x98e694d0, ftLastAccessTime.dwHighDateTime=0x1d827e2, ftLastWriteTime.dwLowDateTime=0x1d065444, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x16a0)) returned 1
[0147.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0147.939] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80tveovtr5nvyl.swf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\80TvEOvTr5nvyl.swf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\80tveovtr5nvyl.swf.coom")) returned 1
[0147.940] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", lpFilePart=0x0) returned 0x35
[0147.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0147.940] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8h3cx4bvp1nlzr8fhyb.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0147.940] GetFileType (hFile=0x33c) returned 0x1
[0147.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0147.940] GetFileType (hFile=0x33c) returned 0x1
[0147.940] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x7069
[0147.941] ReadFile (in: hFile=0x33c, lpBuffer=0x2339f38, nNumberOfBytesToRead=0x7069, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2339f38*, lpNumberOfBytesRead=0x19eeb0*=0x7069, lpOverlapped=0x0) returned 1
[0147.942] CloseHandle (hObject=0x33c) returned 1
[0147.985] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", lpFilePart=0x0) returned 0x35
[0147.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0147.985] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8h3cx4bvp1nlzr8fhyb.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0147.986] GetFileType (hFile=0x33c) returned 0x1
[0147.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0147.987] GetFileType (hFile=0x33c) returned 0x1
[0147.987] WriteFile (in: hFile=0x33c, lpBuffer=0x23a9f2c*, nNumberOfBytesToWrite=0x7070, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23a9f2c*, lpNumberOfBytesWritten=0x19eea0*=0x7070, lpOverlapped=0x0) returned 1
[0147.989] CloseHandle (hObject=0x33c) returned 1
[0147.992] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf", lpFilePart=0x0) returned 0x35
[0147.992] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf.coom", lpFilePart=0x0) returned 0x3a
[0147.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0147.993] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8h3cx4bvp1nlzr8fhyb.swf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1c49570, ftCreationTime.dwHighDateTime=0x1d825f7, ftLastAccessTime.dwLowDateTime=0xe3e47740, ftLastAccessTime.dwHighDateTime=0x1d829e5, ftLastWriteTime.dwLowDateTime=0x1d0e9a4f, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7070)) returned 1
[0147.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0147.993] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8h3cx4bvp1nlzr8fhyb.swf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8H3cx4bVP1NLZr8fhYb.swf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8h3cx4bvp1nlzr8fhyb.swf.coom")) returned 1
[0147.994] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", lpFilePart=0x0) returned 0x34
[0147.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0147.994] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a6cimczxy2f3jxyrzk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0147.995] GetFileType (hFile=0x33c) returned 0x1
[0147.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0147.995] GetFileType (hFile=0x33c) returned 0x1
[0147.995] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xb505
[0147.997] ReadFile (in: hFile=0x33c, lpBuffer=0x23b1360, nNumberOfBytesToRead=0xb505, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23b1360*, lpNumberOfBytesRead=0x19eeb0*=0xb505, lpOverlapped=0x0) returned 1
[0147.999] CloseHandle (hObject=0x33c) returned 1
[0148.128] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", lpFilePart=0x0) returned 0x34
[0148.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.128] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a6cimczxy2f3jxyrzk.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.130] GetFileType (hFile=0x33c) returned 0x1
[0148.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.130] GetFileType (hFile=0x33c) returned 0x1
[0148.130] WriteFile (in: hFile=0x33c, lpBuffer=0x22434a4*, nNumberOfBytesToWrite=0xb510, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22434a4*, lpNumberOfBytesWritten=0x19eea0*=0xb510, lpOverlapped=0x0) returned 1
[0148.132] CloseHandle (hObject=0x33c) returned 1
[0148.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png", lpFilePart=0x0) returned 0x34
[0148.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png.coom", lpFilePart=0x0) returned 0x39
[0148.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.134] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a6cimczxy2f3jxyrzk.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6165860, ftCreationTime.dwHighDateTime=0x1d81d21, ftLastAccessTime.dwLowDateTime=0x364c0e10, ftLastAccessTime.dwHighDateTime=0x1d8269b, ftLastWriteTime.dwLowDateTime=0x1d244778, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xb510)) returned 1
[0148.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.135] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a6cimczxy2f3jxyrzk.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A6CiMczxY2F3JXYRzK.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a6cimczxy2f3jxyrzk.png.coom")) returned 1
[0148.135] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", lpFilePart=0x0) returned 0x27
[0148.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.136] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a9li7.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.136] GetFileType (hFile=0x33c) returned 0x1
[0148.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.136] GetFileType (hFile=0x33c) returned 0x1
[0148.136] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x18629
[0148.138] ReadFile (in: hFile=0x33c, lpBuffer=0x31f8870, nNumberOfBytesToRead=0x18629, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x31f8870*, lpNumberOfBytesRead=0x19eeb0*=0x18629, lpOverlapped=0x0) returned 1
[0148.140] CloseHandle (hObject=0x33c) returned 1
[0148.167] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", lpFilePart=0x0) returned 0x27
[0148.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.168] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a9li7.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.170] GetFileType (hFile=0x33c) returned 0x1
[0148.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.170] GetFileType (hFile=0x33c) returned 0x1
[0148.170] WriteFile (in: hFile=0x33c, lpBuffer=0x3272798*, nNumberOfBytesToWrite=0x18630, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3272798*, lpNumberOfBytesWritten=0x19eea0*=0x18630, lpOverlapped=0x0) returned 1
[0148.175] CloseHandle (hObject=0x33c) returned 1
[0148.178] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp", lpFilePart=0x0) returned 0x27
[0148.178] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp.coom", lpFilePart=0x0) returned 0x2c
[0148.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a9li7.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ed61e80, ftCreationTime.dwHighDateTime=0x1d8280e, ftLastAccessTime.dwLowDateTime=0xb7188b20, ftLastAccessTime.dwHighDateTime=0x1d828aa, ftLastWriteTime.dwLowDateTime=0x1d2b00af, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x18630)) returned 1
[0148.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.179] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a9li7.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\A9li7.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\a9li7.bmp.coom")) returned 1
[0148.180] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", lpFilePart=0x0) returned 0x26
[0148.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.180] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aa9p.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.180] GetFileType (hFile=0x33c) returned 0x1
[0148.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.180] GetFileType (hFile=0x33c) returned 0x1
[0148.180] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xe6d6
[0148.180] ReadFile (in: hFile=0x33c, lpBuffer=0x229bf60, nNumberOfBytesToRead=0xe6d6, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x229bf60*, lpNumberOfBytesRead=0x19eeb0*=0xe6d6, lpOverlapped=0x0) returned 1
[0148.182] CloseHandle (hObject=0x33c) returned 1
[0148.241] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", lpFilePart=0x0) returned 0x26
[0148.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.241] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aa9p.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.243] GetFileType (hFile=0x33c) returned 0x1
[0148.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.243] GetFileType (hFile=0x33c) returned 0x1
[0148.243] WriteFile (in: hFile=0x33c, lpBuffer=0x23141d8*, nNumberOfBytesToWrite=0xe6e0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23141d8*, lpNumberOfBytesWritten=0x19eea0*=0xe6e0, lpOverlapped=0x0) returned 1
[0148.245] CloseHandle (hObject=0x33c) returned 1
[0148.250] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png", lpFilePart=0x0) returned 0x26
[0148.250] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png.coom", lpFilePart=0x0) returned 0x2b
[0148.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aa9p.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed4b4370, ftCreationTime.dwHighDateTime=0x1d829e2, ftLastAccessTime.dwLowDateTime=0xe158e200, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0x1d35f27e, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xe6e0)) returned 1
[0148.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.251] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aa9p.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aA9p.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\aa9p.png.coom")) returned 1
[0148.251] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", lpFilePart=0x0) returned 0x32
[0148.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.251] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\fch1helca7cv3kxw.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.251] GetFileType (hFile=0x33c) returned 0x1
[0148.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.252] GetFileType (hFile=0x33c) returned 0x1
[0148.252] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x309f
[0148.252] ReadFile (in: hFile=0x33c, lpBuffer=0x2322c58, nNumberOfBytesToRead=0x309f, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2322c58*, lpNumberOfBytesRead=0x19eeb0*=0x309f, lpOverlapped=0x0) returned 1
[0148.253] CloseHandle (hObject=0x33c) returned 1
[0148.271] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", lpFilePart=0x0) returned 0x32
[0148.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.271] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\fch1helca7cv3kxw.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.272] GetFileType (hFile=0x33c) returned 0x1
[0148.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.272] GetFileType (hFile=0x33c) returned 0x1
[0148.272] WriteFile (in: hFile=0x33c, lpBuffer=0x237ed3c*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x237ed3c*, lpNumberOfBytesWritten=0x19eea0*=0x30a0, lpOverlapped=0x0) returned 1
[0148.284] CloseHandle (hObject=0x33c) returned 1
[0148.286] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png", lpFilePart=0x0) returned 0x32
[0148.286] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png.coom", lpFilePart=0x0) returned 0x37
[0148.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.286] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\fch1helca7cv3kxw.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15588f60, ftCreationTime.dwHighDateTime=0x1d82526, ftLastAccessTime.dwLowDateTime=0x1fa82e70, ftLastAccessTime.dwHighDateTime=0x1d826a3, ftLastWriteTime.dwLowDateTime=0x1d3b5b06, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x30a0)) returned 1
[0148.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.286] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\fch1helca7cv3kxw.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\fch1HElCA7Cv3KXW.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\fch1helca7cv3kxw.png.coom")) returned 1
[0148.287] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", lpFilePart=0x0) returned 0x2c
[0148.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.287] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gpnva1epmh.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.287] GetFileType (hFile=0x33c) returned 0x1
[0148.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.287] GetFileType (hFile=0x33c) returned 0x1
[0148.287] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x17903
[0148.288] ReadFile (in: hFile=0x33c, lpBuffer=0x32a7ba8, nNumberOfBytesToRead=0x17903, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x32a7ba8*, lpNumberOfBytesRead=0x19eeb0*=0x17903, lpOverlapped=0x0) returned 1
[0148.314] CloseHandle (hObject=0x33c) returned 1
[0148.358] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", lpFilePart=0x0) returned 0x2c
[0148.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.358] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gpnva1epmh.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.360] GetFileType (hFile=0x33c) returned 0x1
[0148.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.360] GetFileType (hFile=0x33c) returned 0x1
[0148.360] WriteFile (in: hFile=0x33c, lpBuffer=0x331d928*, nNumberOfBytesToWrite=0x17910, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x331d928*, lpNumberOfBytesWritten=0x19eea0*=0x17910, lpOverlapped=0x0) returned 1
[0148.363] CloseHandle (hObject=0x33c) returned 1
[0148.367] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png", lpFilePart=0x0) returned 0x2c
[0148.367] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png.coom", lpFilePart=0x0) returned 0x31
[0148.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.367] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gpnva1epmh.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6581ff0, ftCreationTime.dwHighDateTime=0x1d82648, ftLastAccessTime.dwLowDateTime=0xa4079e40, ftLastAccessTime.dwHighDateTime=0x1d8285a, ftLastWriteTime.dwLowDateTime=0x1d47b683, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17910)) returned 1
[0148.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.367] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gpnva1epmh.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\gPnVA1epmh.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\gpnva1epmh.png.coom")) returned 1
[0148.368] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", lpFilePart=0x0) returned 0x2d
[0148.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.368] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jkeimg2lccb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.368] GetFileType (hFile=0x33c) returned 0x1
[0148.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.368] GetFileType (hFile=0x33c) returned 0x1
[0148.368] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xe419
[0148.370] ReadFile (in: hFile=0x33c, lpBuffer=0x23cf29c, nNumberOfBytesToRead=0xe419, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23cf29c*, lpNumberOfBytesRead=0x19eeb0*=0xe419, lpOverlapped=0x0) returned 1
[0148.371] CloseHandle (hObject=0x33c) returned 1
[0148.450] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", lpFilePart=0x0) returned 0x2d
[0148.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.450] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jkeimg2lccb.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.452] GetFileType (hFile=0x33c) returned 0x1
[0148.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.452] GetFileType (hFile=0x33c) returned 0x1
[0148.452] WriteFile (in: hFile=0x33c, lpBuffer=0x2446cd4*, nNumberOfBytesToWrite=0xe420, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2446cd4*, lpNumberOfBytesWritten=0x19eea0*=0xe420, lpOverlapped=0x0) returned 1
[0148.455] CloseHandle (hObject=0x33c) returned 1
[0148.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png", lpFilePart=0x0) returned 0x2d
[0148.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png.coom", lpFilePart=0x0) returned 0x32
[0148.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jkeimg2lccb.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f48d9a0, ftCreationTime.dwHighDateTime=0x1d8268b, ftLastAccessTime.dwLowDateTime=0xaa772510, ftLastAccessTime.dwHighDateTime=0x1d827f7, ftLastWriteTime.dwLowDateTime=0x1d5593ed, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xe420)) returned 1
[0148.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.458] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jkeimg2lccb.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\jKEImg2LCcB.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\jkeimg2lccb.png.coom")) returned 1
[0148.458] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", lpFilePart=0x0) returned 0x2c
[0148.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.459] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\kfzsu2uze8.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.459] GetFileType (hFile=0x33c) returned 0x1
[0148.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.459] GetFileType (hFile=0x33c) returned 0x1
[0148.459] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x7869
[0148.460] ReadFile (in: hFile=0x33c, lpBuffer=0x2455448, nNumberOfBytesToRead=0x7869, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2455448*, lpNumberOfBytesRead=0x19eeb0*=0x7869, lpOverlapped=0x0) returned 1
[0148.461] CloseHandle (hObject=0x33c) returned 1
[0148.532] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", lpFilePart=0x0) returned 0x2c
[0148.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.532] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\kfzsu2uze8.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.534] GetFileType (hFile=0x33c) returned 0x1
[0148.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.534] GetFileType (hFile=0x33c) returned 0x1
[0148.534] WriteFile (in: hFile=0x33c, lpBuffer=0x2214084*, nNumberOfBytesToWrite=0x7870, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2214084*, lpNumberOfBytesWritten=0x19eea0*=0x7870, lpOverlapped=0x0) returned 1
[0148.535] CloseHandle (hObject=0x33c) returned 1
[0148.541] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg", lpFilePart=0x0) returned 0x2c
[0148.541] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg.coom", lpFilePart=0x0) returned 0x31
[0148.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\kfzsu2uze8.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c171950, ftCreationTime.dwHighDateTime=0x1d81c87, ftLastAccessTime.dwLowDateTime=0xafb147c0, ftLastAccessTime.dwHighDateTime=0x1d826a5, ftLastWriteTime.dwLowDateTime=0x1d626b74, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7870)) returned 1
[0148.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.542] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\kfzsu2uze8.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\kFzsu2uze8.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\kfzsu2uze8.jpg.coom")) returned 1
[0148.542] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", lpFilePart=0x0) returned 0x28
[0148.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.543] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lz59hc.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.543] GetFileType (hFile=0x33c) returned 0x1
[0148.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.543] GetFileType (hFile=0x33c) returned 0x1
[0148.543] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x13527
[0148.543] ReadFile (in: hFile=0x33c, lpBuffer=0x221bc48, nNumberOfBytesToRead=0x13527, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x221bc48*, lpNumberOfBytesRead=0x19eeb0*=0x13527, lpOverlapped=0x0) returned 1
[0148.545] CloseHandle (hObject=0x33c) returned 1
[0148.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", lpFilePart=0x0) returned 0x28
[0148.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.570] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lz59hc.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.572] GetFileType (hFile=0x33c) returned 0x1
[0148.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.572] GetFileType (hFile=0x33c) returned 0x1
[0148.572] WriteFile (in: hFile=0x33c, lpBuffer=0x22a2b0c*, nNumberOfBytesToWrite=0x13530, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22a2b0c*, lpNumberOfBytesWritten=0x19eea0*=0x13530, lpOverlapped=0x0) returned 1
[0148.575] CloseHandle (hObject=0x33c) returned 1
[0148.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls", lpFilePart=0x0) returned 0x28
[0148.578] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls.coom", lpFilePart=0x0) returned 0x2d
[0148.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.578] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lz59hc.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ddc3eb0, ftCreationTime.dwHighDateTime=0x1d82731, ftLastAccessTime.dwLowDateTime=0xf7465ec0, ftLastAccessTime.dwHighDateTime=0x1d827ce, ftLastWriteTime.dwLowDateTime=0x1d67edd3, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13530)) returned 1
[0148.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.578] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lz59hc.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\lZ59hc.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\lz59hc.xls.coom")) returned 1
[0148.579] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", lpFilePart=0x0) returned 0x30
[0148.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.579] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ni-ynzgfo-bdwg.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.579] GetFileType (hFile=0x33c) returned 0x1
[0148.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.579] GetFileType (hFile=0x33c) returned 0x1
[0148.579] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x7f4d
[0148.579] ReadFile (in: hFile=0x33c, lpBuffer=0x22b6388, nNumberOfBytesToRead=0x7f4d, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22b6388*, lpNumberOfBytesRead=0x19eeb0*=0x7f4d, lpOverlapped=0x0) returned 1
[0148.581] CloseHandle (hObject=0x33c) returned 1
[0148.600] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", lpFilePart=0x0) returned 0x30
[0148.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.600] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ni-ynzgfo-bdwg.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.605] GetFileType (hFile=0x33c) returned 0x1
[0148.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.605] GetFileType (hFile=0x33c) returned 0x1
[0148.605] WriteFile (in: hFile=0x33c, lpBuffer=0x232addc*, nNumberOfBytesToWrite=0x7f50, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x232addc*, lpNumberOfBytesWritten=0x19eea0*=0x7f50, lpOverlapped=0x0) returned 1
[0148.606] CloseHandle (hObject=0x33c) returned 1
[0148.608] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods", lpFilePart=0x0) returned 0x30
[0148.608] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods.coom", lpFilePart=0x0) returned 0x35
[0148.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ni-ynzgfo-bdwg.ods"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc94b9910, ftCreationTime.dwHighDateTime=0x1d824f2, ftLastAccessTime.dwLowDateTime=0xfa5db2b0, ftLastAccessTime.dwHighDateTime=0x1d82522, ftLastWriteTime.dwLowDateTime=0x1d6c9f12, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7f50)) returned 1
[0148.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.609] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ni-ynzgfo-bdwg.ods"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\nI-Ynzgfo-bdwG.ods.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\ni-ynzgfo-bdwg.ods.coom")) returned 1
[0148.610] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", lpFilePart=0x0) returned 0x2c
[0148.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.610] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qxmcjswp9c.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.610] GetFileType (hFile=0x33c) returned 0x1
[0148.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.610] GetFileType (hFile=0x33c) returned 0x1
[0148.610] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x128b6
[0148.610] ReadFile (in: hFile=0x33c, lpBuffer=0x23330d0, nNumberOfBytesToRead=0x128b6, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23330d0*, lpNumberOfBytesRead=0x19eeb0*=0x128b6, lpOverlapped=0x0) returned 1
[0148.612] CloseHandle (hObject=0x33c) returned 1
[0148.639] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", lpFilePart=0x0) returned 0x2c
[0148.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.639] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qxmcjswp9c.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.641] GetFileType (hFile=0x33c) returned 0x1
[0148.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.641] GetFileType (hFile=0x33c) returned 0x1
[0148.641] WriteFile (in: hFile=0x33c, lpBuffer=0x23b78e8*, nNumberOfBytesToWrite=0x128c0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23b78e8*, lpNumberOfBytesWritten=0x19eea0*=0x128c0, lpOverlapped=0x0) returned 1
[0148.644] CloseHandle (hObject=0x33c) returned 1
[0148.647] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf", lpFilePart=0x0) returned 0x2c
[0148.647] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf.coom", lpFilePart=0x0) returned 0x31
[0148.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qxmcjswp9c.swf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20339d60, ftCreationTime.dwHighDateTime=0x1d81d12, ftLastAccessTime.dwLowDateTime=0x245234d0, ftLastAccessTime.dwHighDateTime=0x1d8276f, ftLastWriteTime.dwLowDateTime=0x1d727e3c, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x128c0)) returned 1
[0148.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.647] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qxmcjswp9c.swf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\qxMCjsWp9C.swf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\qxmcjswp9c.swf.coom")) returned 1
[0148.648] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", lpFilePart=0x0) returned 0x29
[0148.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.648] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\rfezxhy.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.648] GetFileType (hFile=0x33c) returned 0x1
[0148.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.648] GetFileType (hFile=0x33c) returned 0x1
[0148.648] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x13019
[0148.648] ReadFile (in: hFile=0x33c, lpBuffer=0x23ca4e4, nNumberOfBytesToRead=0x13019, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23ca4e4*, lpNumberOfBytesRead=0x19eeb0*=0x13019, lpOverlapped=0x0) returned 1
[0148.650] CloseHandle (hObject=0x33c) returned 1
[0148.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", lpFilePart=0x0) returned 0x29
[0148.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.723] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\rfezxhy.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.725] GetFileType (hFile=0x33c) returned 0x1
[0148.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.725] GetFileType (hFile=0x33c) returned 0x1
[0148.725] WriteFile (in: hFile=0x33c, lpBuffer=0x224ff18*, nNumberOfBytesToWrite=0x13020, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x224ff18*, lpNumberOfBytesWritten=0x19eea0*=0x13020, lpOverlapped=0x0) returned 1
[0148.728] CloseHandle (hObject=0x33c) returned 1
[0148.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv", lpFilePart=0x0) returned 0x29
[0148.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv.coom", lpFilePart=0x0) returned 0x2e
[0148.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\rfezxhy.flv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8fb6f0, ftCreationTime.dwHighDateTime=0x1d827a5, ftLastAccessTime.dwLowDateTime=0x823cc880, ftLastAccessTime.dwHighDateTime=0x1d8283c, ftLastWriteTime.dwLowDateTime=0x1d7f4785, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13020)) returned 1
[0148.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.731] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\rfezxhy.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\rfEzxhy.flv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\rfezxhy.flv.coom")) returned 1
[0148.732] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", lpFilePart=0x0) returned 0x2e
[0148.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.732] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s bya0fi2i1a.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.732] GetFileType (hFile=0x33c) returned 0x1
[0148.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.732] GetFileType (hFile=0x33c) returned 0x1
[0148.732] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1836c
[0148.733] ReadFile (in: hFile=0x33c, lpBuffer=0x33c36b8, nNumberOfBytesToRead=0x1836c, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x33c36b8*, lpNumberOfBytesRead=0x19eeb0*=0x1836c, lpOverlapped=0x0) returned 1
[0148.737] CloseHandle (hObject=0x33c) returned 1
[0148.769] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", lpFilePart=0x0) returned 0x2e
[0148.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.769] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s bya0fi2i1a.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.771] GetFileType (hFile=0x33c) returned 0x1
[0148.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.771] GetFileType (hFile=0x33c) returned 0x1
[0148.771] WriteFile (in: hFile=0x33c, lpBuffer=0x343c820*, nNumberOfBytesToWrite=0x18370, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x343c820*, lpNumberOfBytesWritten=0x19eea0*=0x18370, lpOverlapped=0x0) returned 1
[0148.774] CloseHandle (hObject=0x33c) returned 1
[0148.780] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg", lpFilePart=0x0) returned 0x2e
[0148.780] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg.coom", lpFilePart=0x0) returned 0x33
[0148.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s bya0fi2i1a.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63efb400, ftCreationTime.dwHighDateTime=0x1d8206c, ftLastAccessTime.dwLowDateTime=0xf8c06ee0, ftLastAccessTime.dwHighDateTime=0x1d822dc, ftLastWriteTime.dwLowDateTime=0x1d86c806, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x18370)) returned 1
[0148.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.780] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s bya0fi2i1a.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\S byA0FI2i1A.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\s bya0fi2i1a.jpg.coom")) returned 1
[0148.781] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", lpFilePart=0x0) returned 0x35
[0148.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.781] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\uuznnlpt1yyhk2reqd8.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.781] GetFileType (hFile=0x33c) returned 0x1
[0148.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.782] GetFileType (hFile=0x33c) returned 0x1
[0148.782] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x93e4
[0148.782] ReadFile (in: hFile=0x33c, lpBuffer=0x22b0528, nNumberOfBytesToRead=0x93e4, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22b0528*, lpNumberOfBytesRead=0x19eeb0*=0x93e4, lpOverlapped=0x0) returned 1
[0148.783] CloseHandle (hObject=0x33c) returned 1
[0148.864] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", lpFilePart=0x0) returned 0x35
[0148.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.868] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\uuznnlpt1yyhk2reqd8.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.870] GetFileType (hFile=0x33c) returned 0x1
[0148.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.870] GetFileType (hFile=0x33c) returned 0x1
[0148.870] WriteFile (in: hFile=0x33c, lpBuffer=0x232b698*, nNumberOfBytesToWrite=0x93f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x232b698*, lpNumberOfBytesWritten=0x19eea0*=0x93f0, lpOverlapped=0x0) returned 1
[0148.873] CloseHandle (hObject=0x33c) returned 1
[0148.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls", lpFilePart=0x0) returned 0x35
[0148.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls.coom", lpFilePart=0x0) returned 0x3a
[0148.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\uuznnlpt1yyhk2reqd8.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b82ba0, ftCreationTime.dwHighDateTime=0x1d82888, ftLastAccessTime.dwLowDateTime=0x8e980cb0, ftLastAccessTime.dwHighDateTime=0x1d829d2, ftLastWriteTime.dwLowDateTime=0x1d9562ce, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x93f0)) returned 1
[0148.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.876] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\uuznnlpt1yyhk2reqd8.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\UUZnNLpt1yyHK2REqD8.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\uuznnlpt1yyhk2reqd8.xls.coom")) returned 1
[0148.877] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", lpFilePart=0x0) returned 0x26
[0148.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wuho.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.877] GetFileType (hFile=0x33c) returned 0x1
[0148.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.877] GetFileType (hFile=0x33c) returned 0x1
[0148.877] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x252c
[0148.878] ReadFile (in: hFile=0x33c, lpBuffer=0x2334e14, nNumberOfBytesToRead=0x252c, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2334e14*, lpNumberOfBytesRead=0x19eeb0*=0x252c, lpOverlapped=0x0) returned 1
[0148.879] CloseHandle (hObject=0x33c) returned 1
[0148.899] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", lpFilePart=0x0) returned 0x26
[0148.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.900] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wuho.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.901] GetFileType (hFile=0x33c) returned 0x1
[0148.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.901] GetFileType (hFile=0x33c) returned 0x1
[0148.901] WriteFile (in: hFile=0x33c, lpBuffer=0x238d5c4*, nNumberOfBytesToWrite=0x2530, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x238d5c4*, lpNumberOfBytesWritten=0x19eea0*=0x2530, lpOverlapped=0x0) returned 1
[0148.903] CloseHandle (hObject=0x33c) returned 1
[0148.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls", lpFilePart=0x0) returned 0x26
[0148.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls.coom", lpFilePart=0x0) returned 0x2b
[0148.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.904] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wuho.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b642cf0, ftCreationTime.dwHighDateTime=0x1d8296c, ftLastAccessTime.dwLowDateTime=0xdab17dc0, ftLastAccessTime.dwHighDateTime=0x1d82a13, ftLastWriteTime.dwLowDateTime=0x1d99bb98, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x2530)) returned 1
[0148.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.904] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wuho.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\WUHo.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\wuho.xls.coom")) returned 1
[0148.905] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", lpFilePart=0x0) returned 0x2d
[0148.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.905] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y9yc7gft5o-.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.905] GetFileType (hFile=0x33c) returned 0x1
[0148.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.906] GetFileType (hFile=0x33c) returned 0x1
[0148.906] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x40d9
[0148.906] ReadFile (in: hFile=0x33c, lpBuffer=0x238fe04, nNumberOfBytesToRead=0x40d9, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x238fe04*, lpNumberOfBytesRead=0x19eeb0*=0x40d9, lpOverlapped=0x0) returned 1
[0148.907] CloseHandle (hObject=0x33c) returned 1
[0148.945] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", lpFilePart=0x0) returned 0x2d
[0148.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0148.945] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y9yc7gft5o-.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.947] GetFileType (hFile=0x33c) returned 0x1
[0148.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0148.947] GetFileType (hFile=0x33c) returned 0x1
[0148.947] WriteFile (in: hFile=0x33c, lpBuffer=0x21f40e8*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x21f40e8*, lpNumberOfBytesWritten=0x19eea0*=0x40e0, lpOverlapped=0x0) returned 1
[0148.950] CloseHandle (hObject=0x33c) returned 1
[0148.952] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv", lpFilePart=0x0) returned 0x2d
[0148.952] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv.coom", lpFilePart=0x0) returned 0x32
[0148.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0148.952] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y9yc7gft5o-.flv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f94f300, ftCreationTime.dwHighDateTime=0x1d8226e, ftLastAccessTime.dwLowDateTime=0x3c69ff20, ftLastAccessTime.dwHighDateTime=0x1d8249b, ftLastWriteTime.dwLowDateTime=0x1da10b7f, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x40e0)) returned 1
[0148.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0148.953] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y9yc7gft5o-.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Y9Yc7GFT5o-.flv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\y9yc7gft5o-.flv.coom")) returned 1
[0148.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", lpFilePart=0x0) returned 0x2a
[0148.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0148.954] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yc_dgqq9.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0148.954] GetFileType (hFile=0x33c) returned 0x1
[0148.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0148.954] GetFileType (hFile=0x33c) returned 0x1
[0148.954] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xa5e1
[0148.954] ReadFile (in: hFile=0x33c, lpBuffer=0x21f8514, nNumberOfBytesToRead=0xa5e1, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x21f8514*, lpNumberOfBytesRead=0x19eeb0*=0xa5e1, lpOverlapped=0x0) returned 1
[0148.956] CloseHandle (hObject=0x33c) returned 1
[0149.015] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", lpFilePart=0x0) returned 0x2a
[0149.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0149.015] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yc_dgqq9.swf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.017] GetFileType (hFile=0x33c) returned 0x1
[0149.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0149.017] GetFileType (hFile=0x33c) returned 0x1
[0149.017] WriteFile (in: hFile=0x33c, lpBuffer=0x22791e4*, nNumberOfBytesToWrite=0xa5f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22791e4*, lpNumberOfBytesWritten=0x19eea0*=0xa5f0, lpOverlapped=0x0) returned 1
[0149.022] CloseHandle (hObject=0x33c) returned 1
[0149.025] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf", lpFilePart=0x0) returned 0x2a
[0149.025] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf.coom", lpFilePart=0x0) returned 0x2f
[0149.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0149.025] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yc_dgqq9.swf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef413730, ftCreationTime.dwHighDateTime=0x1d81cd5, ftLastAccessTime.dwLowDateTime=0x4d5bae90, ftLastAccessTime.dwHighDateTime=0x1d81f92, ftLastWriteTime.dwLowDateTime=0x1dac0bf2, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xa5f0)) returned 1
[0149.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0149.025] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yc_dgqq9.swf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\Yc_dgQq9.swf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\yc_dgqq9.swf.coom")) returned 1
[0149.027] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", lpFilePart=0x0) returned 0x31
[0149.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0149.027] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\_z9 qmoefbbr2ho.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.028] GetFileType (hFile=0x33c) returned 0x1
[0149.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0149.028] GetFileType (hFile=0x33c) returned 0x1
[0149.028] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x177e4
[0149.029] ReadFile (in: hFile=0x33c, lpBuffer=0x3454bb0, nNumberOfBytesToRead=0x177e4, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3454bb0*, lpNumberOfBytesRead=0x19eeb0*=0x177e4, lpOverlapped=0x0) returned 1
[0149.035] CloseHandle (hObject=0x33c) returned 1
[0149.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", lpFilePart=0x0) returned 0x31
[0149.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0149.080] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\_z9 qmoefbbr2ho.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.082] GetFileType (hFile=0x33c) returned 0x1
[0149.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0149.082] GetFileType (hFile=0x33c) returned 0x1
[0149.082] WriteFile (in: hFile=0x33c, lpBuffer=0x31e1e50*, nNumberOfBytesToWrite=0x177f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x31e1e50*, lpNumberOfBytesWritten=0x19eea0*=0x177f0, lpOverlapped=0x0) returned 1
[0149.085] CloseHandle (hObject=0x33c) returned 1
[0149.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png", lpFilePart=0x0) returned 0x31
[0149.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png.coom", lpFilePart=0x0) returned 0x36
[0149.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0149.089] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\_z9 qmoefbbr2ho.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb29820, ftCreationTime.dwHighDateTime=0x1d826f7, ftLastAccessTime.dwLowDateTime=0x800b3010, ftLastAccessTime.dwHighDateTime=0x1d8297c, ftLastWriteTime.dwLowDateTime=0x1db5ebc4, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x177f0)) returned 1
[0149.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0149.090] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\_z9 qmoefbbr2ho.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\_z9 qmOEfbbR2Ho.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\_z9 qmoefbbr2ho.png.coom")) returned 1
[0149.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0149.091] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu", lpFilePart=0x0) returned 0x23
[0149.091] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\", lpFilePart=0x0) returned 0x24
[0149.092] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690760
[0149.092] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0149.093] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892c30, ftCreationTime.dwHighDateTime=0x1d81b6b, ftLastAccessTime.dwLowDateTime=0x2f11a690, ftLastAccessTime.dwHighDateTime=0x1d82363, ftLastWriteTime.dwLowDateTime=0x2f11a690, ftLastWriteTime.dwHighDateTime=0x1d82363, nFileSizeHigh=0x0, nFileSizeLow=0x1866, dwReserved0=0x0, dwReserved1=0x0, cFileName="0b2BYJ.bmp", cAlternateFileName="")) returned 1
[0149.093] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8329e890, ftCreationTime.dwHighDateTime=0x1d82413, ftLastAccessTime.dwLowDateTime=0x2e51fa0, ftLastAccessTime.dwHighDateTime=0x1d826c6, ftLastWriteTime.dwLowDateTime=0x2e51fa0, ftLastWriteTime.dwHighDateTime=0x1d826c6, nFileSizeHigh=0x0, nFileSizeLow=0xa084, dwReserved0=0x0, dwReserved1=0x0, cFileName="bCDo3xL3DQNnY-NDn8o.csv", cAlternateFileName="BCDO3X~1.CSV")) returned 1
[0149.093] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75560, ftCreationTime.dwHighDateTime=0x1d8242d, ftLastAccessTime.dwLowDateTime=0x42763500, ftLastAccessTime.dwHighDateTime=0x1d82711, ftLastWriteTime.dwLowDateTime=0x42763500, ftLastWriteTime.dwHighDateTime=0x1d82711, nFileSizeHigh=0x0, nFileSizeLow=0x7551, dwReserved0=0x0, dwReserved1=0x0, cFileName="BP7Hlx-dC.docx", cAlternateFileName="BP7HLX~1.DOC")) returned 1
[0149.094] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f277160, ftCreationTime.dwHighDateTime=0x1d82782, ftLastAccessTime.dwLowDateTime=0x1a8090e0, ftLastAccessTime.dwHighDateTime=0x1d827ca, ftLastWriteTime.dwLowDateTime=0x1a8090e0, ftLastWriteTime.dwHighDateTime=0x1d827ca, nFileSizeHigh=0x0, nFileSizeLow=0xeee5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPcUPq7bjO.gif", cAlternateFileName="FPCUPQ~1.GIF")) returned 1
[0149.094] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821f4fc0, ftCreationTime.dwHighDateTime=0x1d8271b, ftLastAccessTime.dwLowDateTime=0x8071e040, ftLastAccessTime.dwHighDateTime=0x1d827ff, ftLastWriteTime.dwLowDateTime=0x8071e040, ftLastWriteTime.dwHighDateTime=0x1d827ff, nFileSizeHigh=0x0, nFileSizeLow=0xdd89, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTPNUNi5N0PRF7q49.flv", cAlternateFileName="HTPNUN~1.FLV")) returned 1
[0149.094] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lohkShS91M7hT3L", cAlternateFileName="LOHKSH~1")) returned 1
[0149.095] FindNextFileW (in: hFindFile=0x690760, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lohkShS91M7hT3L", cAlternateFileName="LOHKSH~1")) returned 0
[0149.096] FindClose (in: hFindFile=0x690760 | out: hFindFile=0x690760) returned 1
[0149.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1
[0149.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1
[0149.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0149.096] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu", lpFilePart=0x0) returned 0x23
[0149.096] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\", lpFilePart=0x0) returned 0x24
[0149.097] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690560
[0149.098] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb1565b10, ftCreationTime.dwHighDateTime=0x1d81fe8, ftLastAccessTime.dwLowDateTime=0x5d62ff60, ftLastAccessTime.dwHighDateTime=0x1d8248c, ftLastWriteTime.dwLowDateTime=0x5d62ff60, ftLastWriteTime.dwHighDateTime=0x1d8248c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0149.098] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892c30, ftCreationTime.dwHighDateTime=0x1d81b6b, ftLastAccessTime.dwLowDateTime=0x2f11a690, ftLastAccessTime.dwHighDateTime=0x1d82363, ftLastWriteTime.dwLowDateTime=0x2f11a690, ftLastWriteTime.dwHighDateTime=0x1d82363, nFileSizeHigh=0x0, nFileSizeLow=0x1866, dwReserved0=0x0, dwReserved1=0x0, cFileName="0b2BYJ.bmp", cAlternateFileName="")) returned 1
[0149.099] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8329e890, ftCreationTime.dwHighDateTime=0x1d82413, ftLastAccessTime.dwLowDateTime=0x2e51fa0, ftLastAccessTime.dwHighDateTime=0x1d826c6, ftLastWriteTime.dwLowDateTime=0x2e51fa0, ftLastWriteTime.dwHighDateTime=0x1d826c6, nFileSizeHigh=0x0, nFileSizeLow=0xa084, dwReserved0=0x0, dwReserved1=0x0, cFileName="bCDo3xL3DQNnY-NDn8o.csv", cAlternateFileName="BCDO3X~1.CSV")) returned 1
[0149.100] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75560, ftCreationTime.dwHighDateTime=0x1d8242d, ftLastAccessTime.dwLowDateTime=0x42763500, ftLastAccessTime.dwHighDateTime=0x1d82711, ftLastWriteTime.dwLowDateTime=0x42763500, ftLastWriteTime.dwHighDateTime=0x1d82711, nFileSizeHigh=0x0, nFileSizeLow=0x7551, dwReserved0=0x0, dwReserved1=0x0, cFileName="BP7Hlx-dC.docx", cAlternateFileName="BP7HLX~1.DOC")) returned 1
[0149.101] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f277160, ftCreationTime.dwHighDateTime=0x1d82782, ftLastAccessTime.dwLowDateTime=0x1a8090e0, ftLastAccessTime.dwHighDateTime=0x1d827ca, ftLastWriteTime.dwLowDateTime=0x1a8090e0, ftLastWriteTime.dwHighDateTime=0x1d827ca, nFileSizeHigh=0x0, nFileSizeLow=0xeee5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPcUPq7bjO.gif", cAlternateFileName="FPCUPQ~1.GIF")) returned 1
[0149.101] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821f4fc0, ftCreationTime.dwHighDateTime=0x1d8271b, ftLastAccessTime.dwLowDateTime=0x8071e040, ftLastAccessTime.dwHighDateTime=0x1d827ff, ftLastWriteTime.dwLowDateTime=0x8071e040, ftLastWriteTime.dwHighDateTime=0x1d827ff, nFileSizeHigh=0x0, nFileSizeLow=0xdd89, dwReserved0=0x0, dwReserved1=0x0, cFileName="HTPNUNi5N0PRF7q49.flv", cAlternateFileName="HTPNUN~1.FLV")) returned 1
[0149.102] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lohkShS91M7hT3L", cAlternateFileName="LOHKSH~1")) returned 1
[0149.103] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0149.103] FindClose (in: hFindFile=0x690560 | out: hFindFile=0x690560) returned 1
[0149.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1
[0149.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1
[0149.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", nBufferLength=0x105, lpBuffer=0x19e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", lpFilePart=0x0) returned 0x2e
[0149.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1
[0149.107] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\0b2byj.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.107] GetFileType (hFile=0x33c) returned 0x1
[0149.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1
[0149.107] GetFileType (hFile=0x33c) returned 0x1
[0149.107] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19eec4 | out: lpFileSizeHigh=0x19eec4*=0x0) returned 0x1866
[0149.107] ReadFile (in: hFile=0x33c, lpBuffer=0x21db074, nNumberOfBytesToRead=0x1866, lpNumberOfBytesRead=0x19ee70, lpOverlapped=0x0 | out: lpBuffer=0x21db074*, lpNumberOfBytesRead=0x19ee70*=0x1866, lpOverlapped=0x0) returned 1
[0149.109] CloseHandle (hObject=0x33c) returned 1
[0149.207] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", nBufferLength=0x105, lpBuffer=0x19e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", lpFilePart=0x0) returned 0x2e
[0149.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eda4) returned 1
[0149.207] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\0b2byj.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.381] GetFileType (hFile=0x33c) returned 0x1
[0149.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda0) returned 1
[0149.381] GetFileType (hFile=0x33c) returned 0x1
[0149.381] WriteFile (in: hFile=0x33c, lpBuffer=0x222f9c4*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x19ee60, lpOverlapped=0x0 | out: lpBuffer=0x222f9c4*, lpNumberOfBytesWritten=0x19ee60*=0x1870, lpOverlapped=0x0) returned 1
[0149.382] CloseHandle (hObject=0x33c) returned 1
[0149.384] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp", lpFilePart=0x0) returned 0x2e
[0149.384] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp.coom", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp.coom", lpFilePart=0x0) returned 0x33
[0149.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee48) returned 1
[0149.384] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\0b2byj.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19eec4 | out: lpFileInformation=0x19eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892c30, ftCreationTime.dwHighDateTime=0x1d81b6b, ftLastAccessTime.dwLowDateTime=0x2f11a690, ftLastAccessTime.dwHighDateTime=0x1d82363, ftLastWriteTime.dwLowDateTime=0x1de2ec6e, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x1870)) returned 1
[0149.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee44) returned 1
[0149.384] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\0b2byj.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\0b2BYJ.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\0b2byj.bmp.coom")) returned 1
[0149.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", nBufferLength=0x105, lpBuffer=0x19e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", lpFilePart=0x0) returned 0x3b
[0149.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1
[0149.385] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bcdo3xl3dqnny-ndn8o.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.385] GetFileType (hFile=0x33c) returned 0x1
[0149.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1
[0149.385] GetFileType (hFile=0x33c) returned 0x1
[0149.385] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19eec4 | out: lpFileSizeHigh=0x19eec4*=0x0) returned 0xa084
[0149.385] ReadFile (in: hFile=0x33c, lpBuffer=0x22315b4, nNumberOfBytesToRead=0xa084, lpNumberOfBytesRead=0x19ee70, lpOverlapped=0x0 | out: lpBuffer=0x22315b4*, lpNumberOfBytesRead=0x19ee70*=0xa084, lpOverlapped=0x0) returned 1
[0149.387] CloseHandle (hObject=0x33c) returned 1
[0149.408] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", nBufferLength=0x105, lpBuffer=0x19e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", lpFilePart=0x0) returned 0x3b
[0149.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eda4) returned 1
[0149.408] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bcdo3xl3dqnny-ndn8o.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.410] GetFileType (hFile=0x33c) returned 0x1
[0149.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda0) returned 1
[0149.410] GetFileType (hFile=0x33c) returned 0x1
[0149.410] WriteFile (in: hFile=0x33c, lpBuffer=0x22b0644*, nNumberOfBytesToWrite=0xa090, lpNumberOfBytesWritten=0x19ee60, lpOverlapped=0x0 | out: lpBuffer=0x22b0644*, lpNumberOfBytesWritten=0x19ee60*=0xa090, lpOverlapped=0x0) returned 1
[0149.418] CloseHandle (hObject=0x33c) returned 1
[0149.420] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv", lpFilePart=0x0) returned 0x3b
[0149.420] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv.coom", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv.coom", lpFilePart=0x0) returned 0x40
[0149.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee48) returned 1
[0149.420] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bcdo3xl3dqnny-ndn8o.csv"), fInfoLevelId=0x0, lpFileInformation=0x19eec4 | out: lpFileInformation=0x19eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8329e890, ftCreationTime.dwHighDateTime=0x1d82413, ftLastAccessTime.dwLowDateTime=0x2e51fa0, ftLastAccessTime.dwHighDateTime=0x1d826c6, ftLastWriteTime.dwLowDateTime=0x1de872ea, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xa090)) returned 1
[0149.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee44) returned 1
[0149.421] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bcdo3xl3dqnny-ndn8o.csv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\bCDo3xL3DQNnY-NDn8o.csv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bcdo3xl3dqnny-ndn8o.csv.coom")) returned 1
[0149.422] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", nBufferLength=0x105, lpBuffer=0x19e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", lpFilePart=0x0) returned 0x32
[0149.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1
[0149.422] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bp7hlx-dc.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.422] GetFileType (hFile=0x33c) returned 0x1
[0149.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1
[0149.422] GetFileType (hFile=0x33c) returned 0x1
[0149.422] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19eec4 | out: lpFileSizeHigh=0x19eec4*=0x0) returned 0x7551
[0149.422] ReadFile (in: hFile=0x33c, lpBuffer=0x22baab4, nNumberOfBytesToRead=0x7551, lpNumberOfBytesRead=0x19ee70, lpOverlapped=0x0 | out: lpBuffer=0x22baab4*, lpNumberOfBytesRead=0x19ee70*=0x7551, lpOverlapped=0x0) returned 1
[0149.423] CloseHandle (hObject=0x33c) returned 1
[0149.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", nBufferLength=0x105, lpBuffer=0x19e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", lpFilePart=0x0) returned 0x32
[0149.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eda4) returned 1
[0149.445] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bp7hlx-dc.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.447] GetFileType (hFile=0x33c) returned 0x1
[0149.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda0) returned 1
[0149.447] GetFileType (hFile=0x33c) returned 0x1
[0149.447] WriteFile (in: hFile=0x33c, lpBuffer=0x232c358*, nNumberOfBytesToWrite=0x7560, lpNumberOfBytesWritten=0x19ee60, lpOverlapped=0x0 | out: lpBuffer=0x232c358*, lpNumberOfBytesWritten=0x19ee60*=0x7560, lpOverlapped=0x0) returned 1
[0149.449] CloseHandle (hObject=0x33c) returned 1
[0149.451] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx", lpFilePart=0x0) returned 0x32
[0149.451] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx.coom", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx.coom", lpFilePart=0x0) returned 0x37
[0149.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee48) returned 1
[0149.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bp7hlx-dc.docx"), fInfoLevelId=0x0, lpFileInformation=0x19eec4 | out: lpFileInformation=0x19eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75560, ftCreationTime.dwHighDateTime=0x1d8242d, ftLastAccessTime.dwLowDateTime=0x42763500, ftLastAccessTime.dwHighDateTime=0x1d82711, ftLastWriteTime.dwLowDateTime=0x1ded2d2c, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7560)) returned 1
[0149.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee44) returned 1
[0149.453] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bp7hlx-dc.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\BP7Hlx-dC.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\bp7hlx-dc.docx.coom")) returned 1
[0149.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", nBufferLength=0x105, lpBuffer=0x19e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", lpFilePart=0x0) returned 0x39
[0149.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1
[0149.454] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\htpnuni5n0prf7q49.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.454] GetFileType (hFile=0x33c) returned 0x1
[0149.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1
[0149.455] GetFileType (hFile=0x33c) returned 0x1
[0149.455] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19eec4 | out: lpFileSizeHigh=0x19eec4*=0x0) returned 0xdd89
[0149.455] ReadFile (in: hFile=0x33c, lpBuffer=0x2333c70, nNumberOfBytesToRead=0xdd89, lpNumberOfBytesRead=0x19ee70, lpOverlapped=0x0 | out: lpBuffer=0x2333c70*, lpNumberOfBytesRead=0x19ee70*=0xdd89, lpOverlapped=0x0) returned 1
[0149.456] CloseHandle (hObject=0x33c) returned 1
[0149.478] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", nBufferLength=0x105, lpBuffer=0x19e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", lpFilePart=0x0) returned 0x39
[0149.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eda4) returned 1
[0149.478] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\htpnuni5n0prf7q49.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.480] GetFileType (hFile=0x33c) returned 0x1
[0149.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda0) returned 1
[0149.480] GetFileType (hFile=0x33c) returned 0x1
[0149.480] WriteFile (in: hFile=0x33c, lpBuffer=0x23aa2f8*, nNumberOfBytesToWrite=0xdd90, lpNumberOfBytesWritten=0x19ee60, lpOverlapped=0x0 | out: lpBuffer=0x23aa2f8*, lpNumberOfBytesWritten=0x19ee60*=0xdd90, lpOverlapped=0x0) returned 1
[0149.482] CloseHandle (hObject=0x33c) returned 1
[0149.485] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv", lpFilePart=0x0) returned 0x39
[0149.485] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv.coom", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv.coom", lpFilePart=0x0) returned 0x3e
[0149.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee48) returned 1
[0149.485] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\htpnuni5n0prf7q49.flv"), fInfoLevelId=0x0, lpFileInformation=0x19eec4 | out: lpFileInformation=0x19eec4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x821f4fc0, ftCreationTime.dwHighDateTime=0x1d8271b, ftLastAccessTime.dwLowDateTime=0x8071e040, ftLastAccessTime.dwHighDateTime=0x1d827ff, ftLastWriteTime.dwLowDateTime=0x1df269cf, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xdd90)) returned 1
[0149.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee44) returned 1
[0149.486] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\htpnuni5n0prf7q49.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\HTPNUNi5N0PRF7q49.flv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\htpnuni5n0prf7q49.flv.coom")) returned 1
[0149.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0149.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L", nBufferLength=0x105, lpBuffer=0x19e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L", lpFilePart=0x0) returned 0x33
[0149.487] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\", nBufferLength=0x105, lpBuffer=0x19e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\", lpFilePart=0x0) returned 0x34
[0149.487] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\*", lpFindFileData=0x19ebb0 | out: lpFindFileData=0x19ebb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6907e0
[0149.487] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0149.487] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90cf040, ftCreationTime.dwHighDateTime=0x1d8236f, ftLastAccessTime.dwLowDateTime=0x8b446180, ftLastAccessTime.dwHighDateTime=0x1d827e8, ftLastWriteTime.dwLowDateTime=0x8b446180, ftLastWriteTime.dwHighDateTime=0x1d827e8, nFileSizeHigh=0x0, nFileSizeLow=0x9946, dwReserved0=0x0, dwReserved1=0x0, cFileName="- iPNtWwPnLb_xVEK.xlsx", cAlternateFileName="-IPNTW~1.XLS")) returned 1
[0149.488] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4e5350, ftCreationTime.dwHighDateTime=0x1d81e80, ftLastAccessTime.dwLowDateTime=0x51c497c0, ftLastAccessTime.dwHighDateTime=0x1d82876, ftLastWriteTime.dwLowDateTime=0x51c497c0, ftLastWriteTime.dwHighDateTime=0x1d82876, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="a0LPQFabf2-tcp.flv", cAlternateFileName="A0LPQF~1.FLV")) returned 1
[0149.488] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc14880, ftCreationTime.dwHighDateTime=0x1d825c4, ftLastAccessTime.dwLowDateTime=0x3f193060, ftLastAccessTime.dwHighDateTime=0x1d8285b, ftLastWriteTime.dwLowDateTime=0x3f193060, ftLastWriteTime.dwHighDateTime=0x1d8285b, nFileSizeHigh=0x0, nFileSizeLow=0x16b29, dwReserved0=0x0, dwReserved1=0x0, cFileName="J1sasodaPu-SvRdJT307.gif", cAlternateFileName="J1SASO~1.GIF")) returned 1
[0149.488] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76dc4df0, ftCreationTime.dwHighDateTime=0x1d82407, ftLastAccessTime.dwLowDateTime=0xcf922140, ftLastAccessTime.dwHighDateTime=0x1d82425, ftLastWriteTime.dwLowDateTime=0xcf922140, ftLastWriteTime.dwHighDateTime=0x1d82425, nFileSizeHigh=0x0, nFileSizeLow=0xf6c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="T3Pjk61xtk9Sizl9Gz7.jpg", cAlternateFileName="T3PJK6~1.JPG")) returned 1
[0149.488] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc390e1f0, ftCreationTime.dwHighDateTime=0x1d82516, ftLastAccessTime.dwLowDateTime=0xbe82c120, ftLastAccessTime.dwHighDateTime=0x1d82740, ftLastWriteTime.dwLowDateTime=0xbe82c120, ftLastWriteTime.dwHighDateTime=0x1d82740, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wy9hdiHoa5p6DL6.wav", cAlternateFileName="WY9HDI~1.WAV")) returned 1
[0149.492] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0149.492] FindClose (in: hFindFile=0x6907e0 | out: hFindFile=0x6907e0) returned 1
[0149.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee48) returned 1
[0149.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee54) returned 1
[0149.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0149.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L", nBufferLength=0x105, lpBuffer=0x19e990, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L", lpFilePart=0x0) returned 0x33
[0149.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\", nBufferLength=0x105, lpBuffer=0x19e964, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\", lpFilePart=0x0) returned 0x34
[0149.492] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\*", lpFindFileData=0x19ebb0 | out: lpFindFileData=0x19ebb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6907e0
[0149.493] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x89eee8e0, ftCreationTime.dwHighDateTime=0x1d82712, ftLastAccessTime.dwLowDateTime=0x1dbd1410, ftLastAccessTime.dwHighDateTime=0x1d82813, ftLastWriteTime.dwLowDateTime=0x1dbd1410, ftLastWriteTime.dwHighDateTime=0x1d82813, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0149.493] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90cf040, ftCreationTime.dwHighDateTime=0x1d8236f, ftLastAccessTime.dwLowDateTime=0x8b446180, ftLastAccessTime.dwHighDateTime=0x1d827e8, ftLastWriteTime.dwLowDateTime=0x8b446180, ftLastWriteTime.dwHighDateTime=0x1d827e8, nFileSizeHigh=0x0, nFileSizeLow=0x9946, dwReserved0=0x0, dwReserved1=0x0, cFileName="- iPNtWwPnLb_xVEK.xlsx", cAlternateFileName="-IPNTW~1.XLS")) returned 1
[0149.493] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4e5350, ftCreationTime.dwHighDateTime=0x1d81e80, ftLastAccessTime.dwLowDateTime=0x51c497c0, ftLastAccessTime.dwHighDateTime=0x1d82876, ftLastWriteTime.dwLowDateTime=0x51c497c0, ftLastWriteTime.dwHighDateTime=0x1d82876, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="a0LPQFabf2-tcp.flv", cAlternateFileName="A0LPQF~1.FLV")) returned 1
[0149.494] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc14880, ftCreationTime.dwHighDateTime=0x1d825c4, ftLastAccessTime.dwLowDateTime=0x3f193060, ftLastAccessTime.dwHighDateTime=0x1d8285b, ftLastWriteTime.dwLowDateTime=0x3f193060, ftLastWriteTime.dwHighDateTime=0x1d8285b, nFileSizeHigh=0x0, nFileSizeLow=0x16b29, dwReserved0=0x0, dwReserved1=0x0, cFileName="J1sasodaPu-SvRdJT307.gif", cAlternateFileName="J1SASO~1.GIF")) returned 1
[0149.494] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76dc4df0, ftCreationTime.dwHighDateTime=0x1d82407, ftLastAccessTime.dwLowDateTime=0xcf922140, ftLastAccessTime.dwHighDateTime=0x1d82425, ftLastWriteTime.dwLowDateTime=0xcf922140, ftLastWriteTime.dwHighDateTime=0x1d82425, nFileSizeHigh=0x0, nFileSizeLow=0xf6c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="T3Pjk61xtk9Sizl9Gz7.jpg", cAlternateFileName="T3PJK6~1.JPG")) returned 1
[0149.494] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc390e1f0, ftCreationTime.dwHighDateTime=0x1d82516, ftLastAccessTime.dwLowDateTime=0xbe82c120, ftLastAccessTime.dwHighDateTime=0x1d82740, ftLastWriteTime.dwLowDateTime=0xbe82c120, ftLastWriteTime.dwHighDateTime=0x1d82740, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wy9hdiHoa5p6DL6.wav", cAlternateFileName="WY9HDI~1.WAV")) returned 1
[0149.494] FindNextFileW (in: hFindFile=0x6907e0, lpFindFileData=0x19ebc0 | out: lpFindFileData=0x19ebc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc390e1f0, ftCreationTime.dwHighDateTime=0x1d82516, ftLastAccessTime.dwLowDateTime=0xbe82c120, ftLastAccessTime.dwHighDateTime=0x1d82740, ftLastWriteTime.dwLowDateTime=0xbe82c120, ftLastWriteTime.dwHighDateTime=0x1d82740, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wy9hdiHoa5p6DL6.wav", cAlternateFileName="WY9HDI~1.WAV")) returned 0
[0149.494] FindClose (in: hFindFile=0x6907e0 | out: hFindFile=0x6907e0) returned 1
[0149.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee48) returned 1
[0149.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee54) returned 1
[0149.495] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", nBufferLength=0x105, lpBuffer=0x19e888, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", lpFilePart=0x0) returned 0x4a
[0149.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed7c) returned 1
[0149.495] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\- ipntwwpnlb_xvek.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.495] GetFileType (hFile=0x33c) returned 0x1
[0149.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed78) returned 1
[0149.495] GetFileType (hFile=0x33c) returned 0x1
[0149.495] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0x9946
[0149.495] ReadFile (in: hFile=0x33c, lpBuffer=0x23bab48, nNumberOfBytesToRead=0x9946, lpNumberOfBytesRead=0x19ee30, lpOverlapped=0x0 | out: lpBuffer=0x23bab48*, lpNumberOfBytesRead=0x19ee30*=0x9946, lpOverlapped=0x0) returned 1
[0149.498] CloseHandle (hObject=0x33c) returned 1
[0149.564] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", nBufferLength=0x105, lpBuffer=0x19e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", lpFilePart=0x0) returned 0x4a
[0149.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed64) returned 1
[0149.564] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\- ipntwwpnlb_xvek.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.569] GetFileType (hFile=0x33c) returned 0x1
[0149.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1
[0149.569] GetFileType (hFile=0x33c) returned 0x1
[0149.569] WriteFile (in: hFile=0x33c, lpBuffer=0x2241af8*, nNumberOfBytesToWrite=0x9950, lpNumberOfBytesWritten=0x19ee20, lpOverlapped=0x0 | out: lpBuffer=0x2241af8*, lpNumberOfBytesWritten=0x19ee20*=0x9950, lpOverlapped=0x0) returned 1
[0149.572] CloseHandle (hObject=0x33c) returned 1
[0149.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx", lpFilePart=0x0) returned 0x4a
[0149.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx.coom", lpFilePart=0x0) returned 0x4f
[0149.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee08) returned 1
[0149.577] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\- ipntwwpnlb_xvek.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ee84 | out: lpFileInformation=0x19ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc90cf040, ftCreationTime.dwHighDateTime=0x1d8236f, ftLastAccessTime.dwLowDateTime=0x8b446180, ftLastAccessTime.dwHighDateTime=0x1d827e8, ftLastWriteTime.dwLowDateTime=0x1e0061cf, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x9950)) returned 1
[0149.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee04) returned 1
[0149.578] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\- ipntwwpnlb_xvek.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\- iPNtWwPnLb_xVEK.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\- ipntwwpnlb_xvek.xlsx.coom")) returned 1
[0149.579] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", nBufferLength=0x105, lpBuffer=0x19e888, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", lpFilePart=0x0) returned 0x46
[0149.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed7c) returned 1
[0149.579] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\a0lpqfabf2-tcp.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.580] GetFileType (hFile=0x33c) returned 0x1
[0149.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed78) returned 1
[0149.580] GetFileType (hFile=0x33c) returned 0x1
[0149.580] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0x6b8
[0149.580] ReadFile (in: hFile=0x33c, lpBuffer=0x224bf94, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19ee30, lpOverlapped=0x0 | out: lpBuffer=0x224bf94*, lpNumberOfBytesRead=0x19ee30*=0x6b8, lpOverlapped=0x0) returned 1
[0149.581] CloseHandle (hObject=0x33c) returned 1
[0149.806] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", nBufferLength=0x105, lpBuffer=0x19e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", lpFilePart=0x0) returned 0x46
[0149.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed64) returned 1
[0149.806] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\a0lpqfabf2-tcp.flv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.807] GetFileType (hFile=0x33c) returned 0x1
[0149.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1
[0149.807] GetFileType (hFile=0x33c) returned 0x1
[0149.807] WriteFile (in: hFile=0x33c, lpBuffer=0x229c1b0*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x19edf4, lpOverlapped=0x0 | out: lpBuffer=0x229c1b0*, lpNumberOfBytesWritten=0x19edf4*=0x6c0, lpOverlapped=0x0) returned 1
[0149.809] CloseHandle (hObject=0x33c) returned 1
[0149.810] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv", lpFilePart=0x0) returned 0x46
[0149.810] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv.coom", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv.coom", lpFilePart=0x0) returned 0x4b
[0149.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee08) returned 1
[0149.811] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\a0lpqfabf2-tcp.flv"), fInfoLevelId=0x0, lpFileInformation=0x19ee84 | out: lpFileInformation=0x19ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f4e5350, ftCreationTime.dwHighDateTime=0x1d81e80, ftLastAccessTime.dwLowDateTime=0x51c497c0, ftLastAccessTime.dwHighDateTime=0x1d82876, ftLastWriteTime.dwLowDateTime=0x1e240127, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x6c0)) returned 1
[0149.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee04) returned 1
[0149.811] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\a0lpqfabf2-tcp.flv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\a0LPQFabf2-tcp.flv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\a0lpqfabf2-tcp.flv.coom")) returned 1
[0149.811] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", nBufferLength=0x105, lpBuffer=0x19e888, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", lpFilePart=0x0) returned 0x4b
[0149.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed7c) returned 1
[0149.812] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\t3pjk61xtk9sizl9gz7.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.812] GetFileType (hFile=0x33c) returned 0x1
[0149.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed78) returned 1
[0149.812] GetFileType (hFile=0x33c) returned 0x1
[0149.812] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0xf6c2
[0149.812] ReadFile (in: hFile=0x33c, lpBuffer=0x229d50c, nNumberOfBytesToRead=0xf6c2, lpNumberOfBytesRead=0x19ee30, lpOverlapped=0x0 | out: lpBuffer=0x229d50c*, lpNumberOfBytesRead=0x19ee30*=0xf6c2, lpOverlapped=0x0) returned 1
[0149.813] CloseHandle (hObject=0x33c) returned 1
[0149.835] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", nBufferLength=0x105, lpBuffer=0x19e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", lpFilePart=0x0) returned 0x4b
[0149.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed64) returned 1
[0149.835] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\t3pjk61xtk9sizl9gz7.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.837] GetFileType (hFile=0x33c) returned 0x1
[0149.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1
[0149.838] GetFileType (hFile=0x33c) returned 0x1
[0149.838] WriteFile (in: hFile=0x33c, lpBuffer=0x2318754*, nNumberOfBytesToWrite=0xf6d0, lpNumberOfBytesWritten=0x19ee20, lpOverlapped=0x0 | out: lpBuffer=0x2318754*, lpNumberOfBytesWritten=0x19ee20*=0xf6d0, lpOverlapped=0x0) returned 1
[0149.843] CloseHandle (hObject=0x33c) returned 1
[0149.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg", lpFilePart=0x0) returned 0x4b
[0149.847] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg.coom", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg.coom", lpFilePart=0x0) returned 0x50
[0149.847] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee08) returned 1
[0149.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\t3pjk61xtk9sizl9gz7.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ee84 | out: lpFileInformation=0x19ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76dc4df0, ftCreationTime.dwHighDateTime=0x1d82407, ftLastAccessTime.dwLowDateTime=0xcf922140, ftLastAccessTime.dwHighDateTime=0x1d82425, ftLastWriteTime.dwLowDateTime=0x1e2992a8, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xf6d0)) returned 1
[0149.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee04) returned 1
[0149.847] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\t3pjk61xtk9sizl9gz7.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\T3Pjk61xtk9Sizl9Gz7.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\t3pjk61xtk9sizl9gz7.jpg.coom")) returned 1
[0149.848] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", nBufferLength=0x105, lpBuffer=0x19e888, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", lpFilePart=0x0) returned 0x47
[0149.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed7c) returned 1
[0149.848] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\wy9hdihoa5p6dl6.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.850] GetFileType (hFile=0x33c) returned 0x1
[0149.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed78) returned 1
[0149.850] GetFileType (hFile=0x33c) returned 0x1
[0149.850] GetFileSize (in: hFile=0x33c, lpFileSizeHigh=0x19ee84 | out: lpFileSizeHigh=0x19ee84*=0x0) returned 0x2366
[0149.851] ReadFile (in: hFile=0x33c, lpBuffer=0x23282b4, nNumberOfBytesToRead=0x2366, lpNumberOfBytesRead=0x19ee30, lpOverlapped=0x0 | out: lpBuffer=0x23282b4*, lpNumberOfBytesRead=0x19ee30*=0x2366, lpOverlapped=0x0) returned 1
[0149.852] CloseHandle (hObject=0x33c) returned 1
[0149.898] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", nBufferLength=0x105, lpBuffer=0x19e870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", lpFilePart=0x0) returned 0x47
[0149.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ed64) returned 1
[0149.899] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\wy9hdihoa5p6dl6.wav"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x33c
[0149.901] GetFileType (hFile=0x33c) returned 0x1
[0149.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ed60) returned 1
[0149.901] GetFileType (hFile=0x33c) returned 0x1
[0149.901] WriteFile (in: hFile=0x33c, lpBuffer=0x23801a8*, nNumberOfBytesToWrite=0x2370, lpNumberOfBytesWritten=0x19ee20, lpOverlapped=0x0 | out: lpBuffer=0x23801a8*, lpNumberOfBytesWritten=0x19ee20*=0x2370, lpOverlapped=0x0) returned 1
[0149.903] CloseHandle (hObject=0x33c) returned 1
[0149.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav", lpFilePart=0x0) returned 0x47
[0149.904] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav.coom", nBufferLength=0x105, lpBuffer=0x19e9a8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav.coom", lpFilePart=0x0) returned 0x4c
[0149.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee08) returned 1
[0149.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\wy9hdihoa5p6dl6.wav"), fInfoLevelId=0x0, lpFileInformation=0x19ee84 | out: lpFileInformation=0x19ee84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc390e1f0, ftCreationTime.dwHighDateTime=0x1d82516, ftLastAccessTime.dwLowDateTime=0xbe82c120, ftLastAccessTime.dwHighDateTime=0x1d82740, ftLastWriteTime.dwLowDateTime=0x1e325e88, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x2370)) returned 1
[0149.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee04) returned 1
[0149.905] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\wy9hdihoa5p6dl6.wav"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\8fuFu\\lohkShS91M7hT3L\\Wy9hdiHoa5p6DL6.wav.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\8fufu\\lohkshs91m7ht3l\\wy9hdihoa5p6dl6.wav.coom")) returned 1
[0149.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1
[0149.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads", lpFilePart=0x0) returned 0x1f
[0149.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads\\", lpFilePart=0x0) returned 0x20
[0149.906] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690a60
[0149.906] FindNextFileW (in: hFindFile=0x690a60, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0149.907] FindNextFileW (in: hFindFile=0x690a60, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0149.907] FindNextFileW (in: hFindFile=0x690a60, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0149.907] FindClose (in: hFindFile=0x690a60 | out: hFindFile=0x690a60) returned 1
[0149.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1
[0149.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1
[0149.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1
[0149.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads", lpFilePart=0x0) returned 0x1f
[0149.908] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Downloads\\", lpFilePart=0x0) returned 0x20
[0149.908] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Downloads\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690560
[0149.908] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0149.908] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0149.909] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x436bc315, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436bc315, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436bc315, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
[0149.909] FindClose (in: hFindFile=0x690560 | out: hFindFile=0x690560) returned 1
[0149.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1
[0149.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1
[0149.920] CoTaskMemAlloc (cb=0x20c) returned 0x6c0078
[0149.920] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x6c0078 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 0x0
[0149.922] CoTaskMemFree (pv=0x6c0078)
[0149.922] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19e9dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f
[0149.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1
[0149.922] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f
[0149.922] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20
[0149.922] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfdace1e5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfdace1e5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690560
[0149.923] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfdace1e5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfdace1e5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0149.925] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1943c5e0, ftCreationTime.dwHighDateTime=0x1d819fa, ftLastAccessTime.dwLowDateTime=0x5f4803e0, ftLastAccessTime.dwHighDateTime=0x1d81b48, ftLastWriteTime.dwLowDateTime=0x5f4803e0, ftLastWriteTime.dwHighDateTime=0x1d81b48, nFileSizeHigh=0x0, nFileSizeLow=0xb923, dwReserved0=0x0, dwReserved1=0x0, cFileName="0tvBM_QdD3TVO2ZA_6P.ods", cAlternateFileName="0TVBM_~1.ODS")) returned 1
[0149.926] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8408450, ftCreationTime.dwHighDateTime=0x1d82055, ftLastAccessTime.dwLowDateTime=0x97412920, ftLastAccessTime.dwHighDateTime=0x1d825e8, ftLastWriteTime.dwLowDateTime=0x97412920, ftLastWriteTime.dwHighDateTime=0x1d825e8, nFileSizeHigh=0x0, nFileSizeLow=0x1835e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1gCPCj5iJQW.csv", cAlternateFileName="1GCPCJ~1.CSV")) returned 1
[0149.926] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11230f20, ftCreationTime.dwHighDateTime=0x1d81deb, ftLastAccessTime.dwLowDateTime=0x9111cb40, ftLastAccessTime.dwHighDateTime=0x1d8294e, ftLastWriteTime.dwLowDateTime=0x9111cb40, ftLastWriteTime.dwHighDateTime=0x1d8294e, nFileSizeHigh=0x0, nFileSizeLow=0x10457, dwReserved0=0x0, dwReserved1=0x0, cFileName="1yj7pDeYv0wl_14KUOPt.rtf", cAlternateFileName="1YJ7PD~1.RTF")) returned 1
[0149.926] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1db8ab0, ftCreationTime.dwHighDateTime=0x1d81a84, ftLastAccessTime.dwLowDateTime=0xfb521090, ftLastAccessTime.dwHighDateTime=0x1d8290e, ftLastWriteTime.dwLowDateTime=0xfb521090, ftLastWriteTime.dwHighDateTime=0x1d8290e, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="22yziHM7PYbi2OW6R.pdf", cAlternateFileName="22YZIH~1.PDF")) returned 1
[0149.926] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a472260, ftCreationTime.dwHighDateTime=0x1d7c456, ftLastAccessTime.dwLowDateTime=0x2e7ac760, ftLastAccessTime.dwHighDateTime=0x1d7d48b, ftLastWriteTime.dwLowDateTime=0x2e7ac760, ftLastWriteTime.dwHighDateTime=0x1d7d48b, nFileSizeHigh=0x0, nFileSizeLow=0xd31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2qxTT.pptx", cAlternateFileName="2QXTT~1.PPT")) returned 1
[0149.926] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d86690, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0x4418c370, ftLastAccessTime.dwHighDateTime=0x1d826fb, ftLastWriteTime.dwLowDateTime=0x4418c370, ftLastWriteTime.dwHighDateTime=0x1d826fb, nFileSizeHigh=0x0, nFileSizeLow=0x9ed1, dwReserved0=0x0, dwReserved1=0x0, cFileName="3wHRRlh-2tUJE8.doc", cAlternateFileName="3WHRRL~1.DOC")) returned 1
[0149.927] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f4c480, ftCreationTime.dwHighDateTime=0x1d8299f, ftLastAccessTime.dwLowDateTime=0xa3827650, ftLastAccessTime.dwHighDateTime=0x1d829e7, ftLastWriteTime.dwLowDateTime=0xa3827650, ftLastWriteTime.dwHighDateTime=0x1d829e7, nFileSizeHigh=0x0, nFileSizeLow=0x1751b, dwReserved0=0x0, dwReserved1=0x0, cFileName="5BYO.pptx", cAlternateFileName="5BYO~1.PPT")) returned 1
[0149.927] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316d7680, ftCreationTime.dwHighDateTime=0x1d82066, ftLastAccessTime.dwLowDateTime=0x2ca42980, ftLastAccessTime.dwHighDateTime=0x1d82496, ftLastWriteTime.dwLowDateTime=0x2ca42980, ftLastWriteTime.dwHighDateTime=0x1d82496, nFileSizeHigh=0x0, nFileSizeLow=0x4dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="6_8C7Suq3sh2Zdvr.ppt", cAlternateFileName="6_8C7S~1.PPT")) returned 1
[0149.927] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8970c0, ftCreationTime.dwHighDateTime=0x1d808ba, ftLastAccessTime.dwLowDateTime=0xd3c996e0, ftLastAccessTime.dwHighDateTime=0x1d80c5f, ftLastWriteTime.dwLowDateTime=0xd3c996e0, ftLastWriteTime.dwHighDateTime=0x1d80c5f, nFileSizeHigh=0x0, nFileSizeLow=0xaeac, dwReserved0=0x0, dwReserved1=0x0, cFileName="7AVZTG3CoeJywumxSZt.docx", cAlternateFileName="7AVZTG~1.DOC")) returned 1
[0149.927] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c31240, ftCreationTime.dwHighDateTime=0x1d81e5a, ftLastAccessTime.dwLowDateTime=0xc96b5a10, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0xc96b5a10, ftLastWriteTime.dwHighDateTime=0x1d82737, nFileSizeHigh=0x0, nFileSizeLow=0xba63, dwReserved0=0x0, dwReserved1=0x0, cFileName="998Wb55hD8qLh4.xls", cAlternateFileName="998WB5~1.XLS")) returned 1
[0149.928] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77eb4ff0, ftCreationTime.dwHighDateTime=0x1d81a22, ftLastAccessTime.dwLowDateTime=0xc802c340, ftLastAccessTime.dwHighDateTime=0x1d81f3d, ftLastWriteTime.dwLowDateTime=0xc802c340, ftLastWriteTime.dwHighDateTime=0x1d81f3d, nFileSizeHigh=0x0, nFileSizeLow=0x17d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="A0KaGTxVHzRgl2NU.ods", cAlternateFileName="A0KAGT~1.ODS")) returned 1
[0149.928] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e388c50, ftCreationTime.dwHighDateTime=0x1d8230e, ftLastAccessTime.dwLowDateTime=0xb9f606f0, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0xb9f606f0, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0xbdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ai3doif_i6aorCOuoq.docx", cAlternateFileName="AI3DOI~1.DOC")) returned 1
[0149.928] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f3e0b0, ftCreationTime.dwHighDateTime=0x1d82304, ftLastAccessTime.dwLowDateTime=0x92fdc3e0, ftLastAccessTime.dwHighDateTime=0x1d82779, ftLastWriteTime.dwLowDateTime=0x92fdc3e0, ftLastWriteTime.dwHighDateTime=0x1d82779, nFileSizeHigh=0x0, nFileSizeLow=0x178c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cJ6K_Ys9JTdNtND8.xlsx", cAlternateFileName="CJ6K_Y~1.XLS")) returned 1
[0149.928] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4372e947, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0149.929] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2eacf0, ftCreationTime.dwHighDateTime=0x1d820b9, ftLastAccessTime.dwLowDateTime=0xe23b67c0, ftLastAccessTime.dwHighDateTime=0x1d8242a, ftLastWriteTime.dwLowDateTime=0xe23b67c0, ftLastWriteTime.dwHighDateTime=0x1d8242a, nFileSizeHigh=0x0, nFileSizeLow=0x14b17, dwReserved0=0x0, dwReserved1=0x0, cFileName="Di-uCCpaTx9R5q.ots", cAlternateFileName="DI-UCC~1.OTS")) returned 1
[0149.929] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650ad7f0, ftCreationTime.dwHighDateTime=0x1d7fad0, ftLastAccessTime.dwLowDateTime=0xa78efc20, ftLastAccessTime.dwHighDateTime=0x1d7fafb, ftLastWriteTime.dwLowDateTime=0xa78efc20, ftLastWriteTime.dwHighDateTime=0x1d7fafb, nFileSizeHigh=0x0, nFileSizeLow=0x15a24, dwReserved0=0x0, dwReserved1=0x0, cFileName="DkBw3ckGM uF2SMdXz.pptx", cAlternateFileName="DKBW3C~1.PPT")) returned 1
[0149.929] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b23a4f0, ftCreationTime.dwHighDateTime=0x1d82157, ftLastAccessTime.dwLowDateTime=0x1ca905c0, ftLastAccessTime.dwHighDateTime=0x1d82412, ftLastWriteTime.dwLowDateTime=0x1ca905c0, ftLastWriteTime.dwHighDateTime=0x1d82412, nFileSizeHigh=0x0, nFileSizeLow=0x184fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="dXzsJ7_sQ.rtf", cAlternateFileName="DXZSJ7~1.RTF")) returned 1
[0149.929] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaafcff60, ftCreationTime.dwHighDateTime=0x1d79da9, ftLastAccessTime.dwLowDateTime=0x28a85380, ftLastAccessTime.dwHighDateTime=0x1d7d8d6, ftLastWriteTime.dwLowDateTime=0x28a85380, ftLastWriteTime.dwHighDateTime=0x1d7d8d6, nFileSizeHigh=0x0, nFileSizeLow=0x3aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="FgTsNOb7Ndvo.xlsx", cAlternateFileName="FGTSNO~1.XLS")) returned 1
[0149.930] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeafe250, ftCreationTime.dwHighDateTime=0x1d7fd14, ftLastAccessTime.dwLowDateTime=0xbc177e80, ftLastAccessTime.dwHighDateTime=0x1d81e21, ftLastWriteTime.dwLowDateTime=0xbc177e80, ftLastWriteTime.dwHighDateTime=0x1d81e21, nFileSizeHigh=0x0, nFileSizeLow=0x18249, dwReserved0=0x0, dwReserved1=0x0, cFileName="fiE7zb85t8B-.pptx", cAlternateFileName="FIE7ZB~1.PPT")) returned 1
[0149.933] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb79abd10, ftCreationTime.dwHighDateTime=0x1d8209f, ftLastAccessTime.dwLowDateTime=0x2f5d36e0, ftLastAccessTime.dwHighDateTime=0x1d82837, ftLastWriteTime.dwLowDateTime=0x2f5d36e0, ftLastWriteTime.dwHighDateTime=0x1d82837, nFileSizeHigh=0x0, nFileSizeLow=0x14e20, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXtU7tJGkArCUt.pptx", cAlternateFileName="FXTU7T~1.PPT")) returned 1
[0149.933] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a84d640, ftCreationTime.dwHighDateTime=0x1d81dbc, ftLastAccessTime.dwLowDateTime=0x5c6943a0, ftLastAccessTime.dwHighDateTime=0x1d826dd, ftLastWriteTime.dwLowDateTime=0x5c6943a0, ftLastWriteTime.dwHighDateTime=0x1d826dd, nFileSizeHigh=0x0, nFileSizeLow=0x5c48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gxt7.rtf", cAlternateFileName="")) returned 1
[0149.934] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fdf1610, ftCreationTime.dwHighDateTime=0x1d81eff, ftLastAccessTime.dwLowDateTime=0x7ae89d30, ftLastAccessTime.dwHighDateTime=0x1d8207f, ftLastWriteTime.dwLowDateTime=0x7ae89d30, ftLastWriteTime.dwHighDateTime=0x1d8207f, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="h8t-RSY oy1WSABM.csv", cAlternateFileName="H8T-RS~1.CSV")) returned 1
[0149.945] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899e2e40, ftCreationTime.dwHighDateTime=0x1d81cf5, ftLastAccessTime.dwLowDateTime=0x5d7c3b20, ftLastAccessTime.dwHighDateTime=0x1d81e96, ftLastWriteTime.dwLowDateTime=0x5d7c3b20, ftLastWriteTime.dwHighDateTime=0x1d81e96, nFileSizeHigh=0x0, nFileSizeLow=0xf2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgaKU.odt", cAlternateFileName="")) returned 1
[0149.945] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f402890, ftCreationTime.dwHighDateTime=0x1d7ba24, ftLastAccessTime.dwLowDateTime=0x7255a3c0, ftLastAccessTime.dwHighDateTime=0x1d7ea74, ftLastWriteTime.dwLowDateTime=0x7255a3c0, ftLastWriteTime.dwHighDateTime=0x1d7ea74, nFileSizeHigh=0x0, nFileSizeLow=0xef62, dwReserved0=0x0, dwReserved1=0x0, cFileName="iriH.docx", cAlternateFileName="IRIH~1.DOC")) returned 1
[0149.945] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee2c490, ftCreationTime.dwHighDateTime=0x1d81b1c, ftLastAccessTime.dwLowDateTime=0x3c989e80, ftLastAccessTime.dwHighDateTime=0x1d81fe0, ftLastWriteTime.dwLowDateTime=0x3c989e80, ftLastWriteTime.dwHighDateTime=0x1d81fe0, nFileSizeHigh=0x0, nFileSizeLow=0x454b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSv2CXAx0sO0nwq3.docx", cAlternateFileName="ISV2CX~1.DOC")) returned 1
[0149.945] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf5fa0, ftCreationTime.dwHighDateTime=0x1d824fe, ftLastAccessTime.dwLowDateTime=0x2639b3f0, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0x2639b3f0, ftLastWriteTime.dwHighDateTime=0x1d82737, nFileSizeHigh=0x0, nFileSizeLow=0x7e53, dwReserved0=0x0, dwReserved1=0x0, cFileName="LXAm.xlsx", cAlternateFileName="LXAM~1.XLS")) returned 1
[0149.946] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927389f0, ftCreationTime.dwHighDateTime=0x1d7a9b1, ftLastAccessTime.dwLowDateTime=0x6cd7edd0, ftLastAccessTime.dwHighDateTime=0x1d7eb15, ftLastWriteTime.dwLowDateTime=0x6cd7edd0, ftLastWriteTime.dwHighDateTime=0x1d7eb15, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LXf5O1UnE8gZ7VPN-X.docx", cAlternateFileName="LXF5O1~1.DOC")) returned 1
[0149.946] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4f2f040, ftCreationTime.dwHighDateTime=0x1d7feac, ftLastAccessTime.dwLowDateTime=0x4744cb10, ftLastAccessTime.dwHighDateTime=0x1d82774, ftLastWriteTime.dwLowDateTime=0x4744cb10, ftLastWriteTime.dwHighDateTime=0x1d82774, nFileSizeHigh=0x0, nFileSizeLow=0x6776, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lxh6PbYU5lGk0.pptx", cAlternateFileName="LXH6PB~1.PPT")) returned 1
[0149.946] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eb80d0, ftCreationTime.dwHighDateTime=0x1d82436, ftLastAccessTime.dwLowDateTime=0x25fb4ab0, ftLastAccessTime.dwHighDateTime=0x1d825df, ftLastWriteTime.dwLowDateTime=0x25fb4ab0, ftLastWriteTime.dwHighDateTime=0x1d825df, nFileSizeHigh=0x0, nFileSizeLow=0x107a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="lyrRYp D-2Z.docx", cAlternateFileName="LYRRYP~1.DOC")) returned 1
[0149.946] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02879f0, ftCreationTime.dwHighDateTime=0x1d826fb, ftLastAccessTime.dwLowDateTime=0xc3865040, ftLastAccessTime.dwHighDateTime=0x1d827ab, ftLastWriteTime.dwLowDateTime=0xc3865040, ftLastWriteTime.dwHighDateTime=0x1d827ab, nFileSizeHigh=0x0, nFileSizeLow=0x13bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNffSwckP FbcIEuI5.doc", cAlternateFileName="MSNFFS~1.DOC")) returned 1
[0149.946] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
[0149.947] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
[0149.947] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
[0149.948] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe55e5d0, ftCreationTime.dwHighDateTime=0x1d81cad, ftLastAccessTime.dwLowDateTime=0xb079e420, ftLastAccessTime.dwHighDateTime=0x1d824d2, ftLastWriteTime.dwLowDateTime=0xb079e420, ftLastWriteTime.dwHighDateTime=0x1d824d2, nFileSizeHigh=0x0, nFileSizeLow=0x3e19, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="n7hKHIqS.rtf", cAlternateFileName="")) returned 1
[0149.948] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc50c0, ftCreationTime.dwHighDateTime=0x1d819fd, ftLastAccessTime.dwLowDateTime=0x5f903f90, ftLastAccessTime.dwHighDateTime=0x1d81b8c, ftLastWriteTime.dwLowDateTime=0x5f903f90, ftLastWriteTime.dwHighDateTime=0x1d81b8c, nFileSizeHigh=0x0, nFileSizeLow=0xf85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ocgatxC-6Ez0Hk_y.xls", cAlternateFileName="OCGATX~1.XLS")) returned 1
[0149.948] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x65ef9a5c, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1
[0149.948] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f827a60, ftCreationTime.dwHighDateTime=0x1d81dca, ftLastAccessTime.dwLowDateTime=0x59dd3ca0, ftLastAccessTime.dwHighDateTime=0x1d823df, ftLastWriteTime.dwLowDateTime=0x59dd3ca0, ftLastWriteTime.dwHighDateTime=0x1d823df, nFileSizeHigh=0x0, nFileSizeLow=0xa3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="owF5pa QZMhBD.rtf", cAlternateFileName="OWF5PA~1.RTF")) returned 1
[0149.948] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc572d180, ftCreationTime.dwHighDateTime=0x1d8296d, ftLastAccessTime.dwLowDateTime=0x9b0dd40, ftLastAccessTime.dwHighDateTime=0x1d829f2, ftLastWriteTime.dwLowDateTime=0x9b0dd40, ftLastWriteTime.dwHighDateTime=0x1d829f2, nFileSizeHigh=0x0, nFileSizeLow=0x4953, dwReserved0=0x0, dwReserved1=0x0, cFileName="p9uL--tRL_6UnNWprC.odt", cAlternateFileName="P9UL--~1.ODT")) returned 1
[0149.949] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc60980, ftCreationTime.dwHighDateTime=0x1d829a0, ftLastAccessTime.dwLowDateTime=0xa1794260, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0xa1794260, ftLastWriteTime.dwHighDateTime=0x1d829f3, nFileSizeHigh=0x0, nFileSizeLow=0x12344, dwReserved0=0x0, dwReserved1=0x0, cFileName="pSJLpn8DrUrz1-Xy6Fw_.pdf", cAlternateFileName="PSJLPN~1.PDF")) returned 1
[0149.949] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6810580, ftCreationTime.dwHighDateTime=0x1d819e3, ftLastAccessTime.dwLowDateTime=0x3c8de40, ftLastAccessTime.dwHighDateTime=0x1d81ed6, ftLastWriteTime.dwLowDateTime=0x3c8de40, ftLastWriteTime.dwHighDateTime=0x1d81ed6, nFileSizeHigh=0x0, nFileSizeLow=0x10b71, dwReserved0=0x0, dwReserved1=0x0, cFileName="q9j2C2vhqGqT8Y.xls", cAlternateFileName="Q9J2C2~1.XLS")) returned 1
[0149.949] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8100020, ftCreationTime.dwHighDateTime=0x1d81323, ftLastAccessTime.dwLowDateTime=0x5835a220, ftLastAccessTime.dwHighDateTime=0x1d821a5, ftLastWriteTime.dwLowDateTime=0x5835a220, ftLastWriteTime.dwHighDateTime=0x1d821a5, nFileSizeHigh=0x0, nFileSizeLow=0x1160, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qi06Dg7iSL hMONv94Db.xlsx", cAlternateFileName="QI06DG~1.XLS")) returned 1
[0149.949] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31a5460, ftCreationTime.dwHighDateTime=0x1d8274a, ftLastAccessTime.dwLowDateTime=0x744511a0, ftLastAccessTime.dwHighDateTime=0x1d82883, ftLastWriteTime.dwLowDateTime=0x744511a0, ftLastWriteTime.dwHighDateTime=0x1d82883, nFileSizeHigh=0x0, nFileSizeLow=0x11ef1, dwReserved0=0x0, dwReserved1=0x0, cFileName="QqWlqDBqRFVAm vqX4DG.pdf", cAlternateFileName="QQWLQD~1.PDF")) returned 1
[0149.949] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38867ac0, ftCreationTime.dwHighDateTime=0x1d827b9, ftLastAccessTime.dwLowDateTime=0x342424e0, ftLastAccessTime.dwHighDateTime=0x1d82823, ftLastWriteTime.dwLowDateTime=0x342424e0, ftLastWriteTime.dwHighDateTime=0x1d82823, nFileSizeHigh=0x0, nFileSizeLow=0x8e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="r6Cg4NKEaRK.ots", cAlternateFileName="R6CG4N~1.OTS")) returned 1
[0149.950] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d63a50, ftCreationTime.dwHighDateTime=0x1d81e3b, ftLastAccessTime.dwLowDateTime=0x72d93c00, ftLastAccessTime.dwHighDateTime=0x1d82988, ftLastWriteTime.dwLowDateTime=0x72d93c00, ftLastWriteTime.dwHighDateTime=0x1d82988, nFileSizeHigh=0x0, nFileSizeLow=0xcfc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDG1tR6SD8R 70ytf.docx", cAlternateFileName="TDG1TR~1.DOC")) returned 1
[0149.950] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53efdbf0, ftCreationTime.dwHighDateTime=0x1d821c2, ftLastAccessTime.dwLowDateTime=0x74932200, ftLastAccessTime.dwHighDateTime=0x1d8270c, ftLastWriteTime.dwLowDateTime=0x74932200, ftLastWriteTime.dwHighDateTime=0x1d8270c, nFileSizeHigh=0x0, nFileSizeLow=0x57f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="uhTnuhWyZPoex.pdf", cAlternateFileName="UHTNUH~1.PDF")) returned 1
[0149.950] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6982eec0, ftCreationTime.dwHighDateTime=0x1d7bba7, ftLastAccessTime.dwLowDateTime=0xbbf9d860, ftLastAccessTime.dwHighDateTime=0x1d7d567, ftLastWriteTime.dwLowDateTime=0xbbf9d860, ftLastWriteTime.dwHighDateTime=0x1d7d567, nFileSizeHigh=0x0, nFileSizeLow=0x5c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="uIwqDmYW8Ql.docx", cAlternateFileName="UIWQDM~1.DOC")) returned 1
[0149.950] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdba143d0, ftCreationTime.dwHighDateTime=0x1d81ec1, ftLastAccessTime.dwLowDateTime=0x1494afb0, ftLastAccessTime.dwHighDateTime=0x1d8202f, ftLastWriteTime.dwLowDateTime=0x1494afb0, ftLastWriteTime.dwHighDateTime=0x1d8202f, nFileSizeHigh=0x0, nFileSizeLow=0x17d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcYEH.doc", cAlternateFileName="")) returned 1
[0149.950] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c075f0, ftCreationTime.dwHighDateTime=0x1d7dd97, ftLastAccessTime.dwLowDateTime=0x3bac3590, ftLastAccessTime.dwHighDateTime=0x1d81aa4, ftLastWriteTime.dwLowDateTime=0x3bac3590, ftLastWriteTime.dwHighDateTime=0x1d81aa4, nFileSizeHigh=0x0, nFileSizeLow=0x79d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="wlZTxESTUgU f3.xlsx", cAlternateFileName="WLZTXE~1.XLS")) returned 1
[0149.951] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61beb0, ftCreationTime.dwHighDateTime=0x1d81aa5, ftLastAccessTime.dwLowDateTime=0x48b00210, ftLastAccessTime.dwHighDateTime=0x1d823ca, ftLastWriteTime.dwLowDateTime=0x48b00210, ftLastWriteTime.dwHighDateTime=0x1d823ca, nFileSizeHigh=0x0, nFileSizeLow=0x16363, dwReserved0=0x0, dwReserved1=0x0, cFileName="WU7S.xls", cAlternateFileName="")) returned 1
[0149.951] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x199007f0, ftCreationTime.dwHighDateTime=0x1d8218b, ftLastAccessTime.dwLowDateTime=0x3e7a2700, ftLastAccessTime.dwHighDateTime=0x1d826f7, ftLastWriteTime.dwLowDateTime=0x3e7a2700, ftLastWriteTime.dwHighDateTime=0x1d826f7, nFileSizeHigh=0x0, nFileSizeLow=0x7e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="wVE9flHzacBjM.pptx", cAlternateFileName="WVE9FL~1.PPT")) returned 1
[0149.951] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148e4700, ftCreationTime.dwHighDateTime=0x1d7e3ea, ftLastAccessTime.dwLowDateTime=0xbefc52e0, ftLastAccessTime.dwHighDateTime=0x1d819d7, ftLastWriteTime.dwLowDateTime=0xbefc52e0, ftLastWriteTime.dwHighDateTime=0x1d819d7, nFileSizeHigh=0x0, nFileSizeLow=0x5a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="y8TckRi KxxqHv9oqq.xlsx", cAlternateFileName="Y8TCKR~1.XLS")) returned 1
[0149.951] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc5da00, ftCreationTime.dwHighDateTime=0x1d7d439, ftLastAccessTime.dwLowDateTime=0xc0d81010, ftLastAccessTime.dwHighDateTime=0x1d7f1bc, ftLastWriteTime.dwLowDateTime=0xc0d81010, ftLastWriteTime.dwHighDateTime=0x1d7f1bc, nFileSizeHigh=0x0, nFileSizeLow=0x17858, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZJRfdPfcL.xlsx", cAlternateFileName="ZJRFDP~1.XLS")) returned 1
[0149.952] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd083fcf0, ftCreationTime.dwHighDateTime=0x1d823c5, ftLastAccessTime.dwLowDateTime=0x7d735750, ftLastAccessTime.dwHighDateTime=0x1d8240f, ftLastWriteTime.dwLowDateTime=0x7d735750, ftLastWriteTime.dwHighDateTime=0x1d8240f, nFileSizeHigh=0x0, nFileSizeLow=0x16987, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZWAFqo.pps", cAlternateFileName="")) returned 1
[0149.952] FindNextFileW (in: hFindFile=0x690560, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0149.952] FindClose (in: hFindFile=0x690560 | out: hFindFile=0x690560) returned 1
[0149.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1
[0149.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1
[0149.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1
[0149.952] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f
[0149.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20
[0149.953] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfdace1e5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfdace1e5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690ae0
[0149.955] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfdace1e5, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfdace1e5, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0149.955] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1943c5e0, ftCreationTime.dwHighDateTime=0x1d819fa, ftLastAccessTime.dwLowDateTime=0x5f4803e0, ftLastAccessTime.dwHighDateTime=0x1d81b48, ftLastWriteTime.dwLowDateTime=0x5f4803e0, ftLastWriteTime.dwHighDateTime=0x1d81b48, nFileSizeHigh=0x0, nFileSizeLow=0xb923, dwReserved0=0x0, dwReserved1=0x0, cFileName="0tvBM_QdD3TVO2ZA_6P.ods", cAlternateFileName="0TVBM_~1.ODS")) returned 1
[0149.955] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8408450, ftCreationTime.dwHighDateTime=0x1d82055, ftLastAccessTime.dwLowDateTime=0x97412920, ftLastAccessTime.dwHighDateTime=0x1d825e8, ftLastWriteTime.dwLowDateTime=0x97412920, ftLastWriteTime.dwHighDateTime=0x1d825e8, nFileSizeHigh=0x0, nFileSizeLow=0x1835e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1gCPCj5iJQW.csv", cAlternateFileName="1GCPCJ~1.CSV")) returned 1
[0149.956] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11230f20, ftCreationTime.dwHighDateTime=0x1d81deb, ftLastAccessTime.dwLowDateTime=0x9111cb40, ftLastAccessTime.dwHighDateTime=0x1d8294e, ftLastWriteTime.dwLowDateTime=0x9111cb40, ftLastWriteTime.dwHighDateTime=0x1d8294e, nFileSizeHigh=0x0, nFileSizeLow=0x10457, dwReserved0=0x0, dwReserved1=0x0, cFileName="1yj7pDeYv0wl_14KUOPt.rtf", cAlternateFileName="1YJ7PD~1.RTF")) returned 1
[0149.956] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1db8ab0, ftCreationTime.dwHighDateTime=0x1d81a84, ftLastAccessTime.dwLowDateTime=0xfb521090, ftLastAccessTime.dwHighDateTime=0x1d8290e, ftLastWriteTime.dwLowDateTime=0xfb521090, ftLastWriteTime.dwHighDateTime=0x1d8290e, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="22yziHM7PYbi2OW6R.pdf", cAlternateFileName="22YZIH~1.PDF")) returned 1
[0149.956] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a472260, ftCreationTime.dwHighDateTime=0x1d7c456, ftLastAccessTime.dwLowDateTime=0x2e7ac760, ftLastAccessTime.dwHighDateTime=0x1d7d48b, ftLastWriteTime.dwLowDateTime=0x2e7ac760, ftLastWriteTime.dwHighDateTime=0x1d7d48b, nFileSizeHigh=0x0, nFileSizeLow=0xd31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="2qxTT.pptx", cAlternateFileName="2QXTT~1.PPT")) returned 1
[0149.956] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d86690, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0x4418c370, ftLastAccessTime.dwHighDateTime=0x1d826fb, ftLastWriteTime.dwLowDateTime=0x4418c370, ftLastWriteTime.dwHighDateTime=0x1d826fb, nFileSizeHigh=0x0, nFileSizeLow=0x9ed1, dwReserved0=0x0, dwReserved1=0x0, cFileName="3wHRRlh-2tUJE8.doc", cAlternateFileName="3WHRRL~1.DOC")) returned 1
[0149.957] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f4c480, ftCreationTime.dwHighDateTime=0x1d8299f, ftLastAccessTime.dwLowDateTime=0xa3827650, ftLastAccessTime.dwHighDateTime=0x1d829e7, ftLastWriteTime.dwLowDateTime=0xa3827650, ftLastWriteTime.dwHighDateTime=0x1d829e7, nFileSizeHigh=0x0, nFileSizeLow=0x1751b, dwReserved0=0x0, dwReserved1=0x0, cFileName="5BYO.pptx", cAlternateFileName="5BYO~1.PPT")) returned 1
[0149.957] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316d7680, ftCreationTime.dwHighDateTime=0x1d82066, ftLastAccessTime.dwLowDateTime=0x2ca42980, ftLastAccessTime.dwHighDateTime=0x1d82496, ftLastWriteTime.dwLowDateTime=0x2ca42980, ftLastWriteTime.dwHighDateTime=0x1d82496, nFileSizeHigh=0x0, nFileSizeLow=0x4dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="6_8C7Suq3sh2Zdvr.ppt", cAlternateFileName="6_8C7S~1.PPT")) returned 1
[0149.957] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8970c0, ftCreationTime.dwHighDateTime=0x1d808ba, ftLastAccessTime.dwLowDateTime=0xd3c996e0, ftLastAccessTime.dwHighDateTime=0x1d80c5f, ftLastWriteTime.dwLowDateTime=0xd3c996e0, ftLastWriteTime.dwHighDateTime=0x1d80c5f, nFileSizeHigh=0x0, nFileSizeLow=0xaeac, dwReserved0=0x0, dwReserved1=0x0, cFileName="7AVZTG3CoeJywumxSZt.docx", cAlternateFileName="7AVZTG~1.DOC")) returned 1
[0149.958] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c31240, ftCreationTime.dwHighDateTime=0x1d81e5a, ftLastAccessTime.dwLowDateTime=0xc96b5a10, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0xc96b5a10, ftLastWriteTime.dwHighDateTime=0x1d82737, nFileSizeHigh=0x0, nFileSizeLow=0xba63, dwReserved0=0x0, dwReserved1=0x0, cFileName="998Wb55hD8qLh4.xls", cAlternateFileName="998WB5~1.XLS")) returned 1
[0149.958] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77eb4ff0, ftCreationTime.dwHighDateTime=0x1d81a22, ftLastAccessTime.dwLowDateTime=0xc802c340, ftLastAccessTime.dwHighDateTime=0x1d81f3d, ftLastWriteTime.dwLowDateTime=0xc802c340, ftLastWriteTime.dwHighDateTime=0x1d81f3d, nFileSizeHigh=0x0, nFileSizeLow=0x17d16, dwReserved0=0x0, dwReserved1=0x0, cFileName="A0KaGTxVHzRgl2NU.ods", cAlternateFileName="A0KAGT~1.ODS")) returned 1
[0149.958] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e388c50, ftCreationTime.dwHighDateTime=0x1d8230e, ftLastAccessTime.dwLowDateTime=0xb9f606f0, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0xb9f606f0, ftLastWriteTime.dwHighDateTime=0x1d8290a, nFileSizeHigh=0x0, nFileSizeLow=0xbdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ai3doif_i6aorCOuoq.docx", cAlternateFileName="AI3DOI~1.DOC")) returned 1
[0149.958] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f3e0b0, ftCreationTime.dwHighDateTime=0x1d82304, ftLastAccessTime.dwLowDateTime=0x92fdc3e0, ftLastAccessTime.dwHighDateTime=0x1d82779, ftLastWriteTime.dwLowDateTime=0x92fdc3e0, ftLastWriteTime.dwHighDateTime=0x1d82779, nFileSizeHigh=0x0, nFileSizeLow=0x178c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cJ6K_Ys9JTdNtND8.xlsx", cAlternateFileName="CJ6K_Y~1.XLS")) returned 1
[0149.959] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43649a85, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43649a85, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x4372e947, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0149.959] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2eacf0, ftCreationTime.dwHighDateTime=0x1d820b9, ftLastAccessTime.dwLowDateTime=0xe23b67c0, ftLastAccessTime.dwHighDateTime=0x1d8242a, ftLastWriteTime.dwLowDateTime=0xe23b67c0, ftLastWriteTime.dwHighDateTime=0x1d8242a, nFileSizeHigh=0x0, nFileSizeLow=0x14b17, dwReserved0=0x0, dwReserved1=0x0, cFileName="Di-uCCpaTx9R5q.ots", cAlternateFileName="DI-UCC~1.OTS")) returned 1
[0149.959] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650ad7f0, ftCreationTime.dwHighDateTime=0x1d7fad0, ftLastAccessTime.dwLowDateTime=0xa78efc20, ftLastAccessTime.dwHighDateTime=0x1d7fafb, ftLastWriteTime.dwLowDateTime=0xa78efc20, ftLastWriteTime.dwHighDateTime=0x1d7fafb, nFileSizeHigh=0x0, nFileSizeLow=0x15a24, dwReserved0=0x0, dwReserved1=0x0, cFileName="DkBw3ckGM uF2SMdXz.pptx", cAlternateFileName="DKBW3C~1.PPT")) returned 1
[0149.960] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b23a4f0, ftCreationTime.dwHighDateTime=0x1d82157, ftLastAccessTime.dwLowDateTime=0x1ca905c0, ftLastAccessTime.dwHighDateTime=0x1d82412, ftLastWriteTime.dwLowDateTime=0x1ca905c0, ftLastWriteTime.dwHighDateTime=0x1d82412, nFileSizeHigh=0x0, nFileSizeLow=0x184fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="dXzsJ7_sQ.rtf", cAlternateFileName="DXZSJ7~1.RTF")) returned 1
[0149.960] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaafcff60, ftCreationTime.dwHighDateTime=0x1d79da9, ftLastAccessTime.dwLowDateTime=0x28a85380, ftLastAccessTime.dwHighDateTime=0x1d7d8d6, ftLastWriteTime.dwLowDateTime=0x28a85380, ftLastWriteTime.dwHighDateTime=0x1d7d8d6, nFileSizeHigh=0x0, nFileSizeLow=0x3aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="FgTsNOb7Ndvo.xlsx", cAlternateFileName="FGTSNO~1.XLS")) returned 1
[0149.960] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeafe250, ftCreationTime.dwHighDateTime=0x1d7fd14, ftLastAccessTime.dwLowDateTime=0xbc177e80, ftLastAccessTime.dwHighDateTime=0x1d81e21, ftLastWriteTime.dwLowDateTime=0xbc177e80, ftLastWriteTime.dwHighDateTime=0x1d81e21, nFileSizeHigh=0x0, nFileSizeLow=0x18249, dwReserved0=0x0, dwReserved1=0x0, cFileName="fiE7zb85t8B-.pptx", cAlternateFileName="FIE7ZB~1.PPT")) returned 1
[0149.960] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb79abd10, ftCreationTime.dwHighDateTime=0x1d8209f, ftLastAccessTime.dwLowDateTime=0x2f5d36e0, ftLastAccessTime.dwHighDateTime=0x1d82837, ftLastWriteTime.dwLowDateTime=0x2f5d36e0, ftLastWriteTime.dwHighDateTime=0x1d82837, nFileSizeHigh=0x0, nFileSizeLow=0x14e20, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXtU7tJGkArCUt.pptx", cAlternateFileName="FXTU7T~1.PPT")) returned 1
[0149.961] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a84d640, ftCreationTime.dwHighDateTime=0x1d81dbc, ftLastAccessTime.dwLowDateTime=0x5c6943a0, ftLastAccessTime.dwHighDateTime=0x1d826dd, ftLastWriteTime.dwLowDateTime=0x5c6943a0, ftLastWriteTime.dwHighDateTime=0x1d826dd, nFileSizeHigh=0x0, nFileSizeLow=0x5c48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gxt7.rtf", cAlternateFileName="")) returned 1
[0149.961] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fdf1610, ftCreationTime.dwHighDateTime=0x1d81eff, ftLastAccessTime.dwLowDateTime=0x7ae89d30, ftLastAccessTime.dwHighDateTime=0x1d8207f, ftLastWriteTime.dwLowDateTime=0x7ae89d30, ftLastWriteTime.dwHighDateTime=0x1d8207f, nFileSizeHigh=0x0, nFileSizeLow=0x1443f, dwReserved0=0x0, dwReserved1=0x0, cFileName="h8t-RSY oy1WSABM.csv", cAlternateFileName="H8T-RS~1.CSV")) returned 1
[0149.961] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899e2e40, ftCreationTime.dwHighDateTime=0x1d81cf5, ftLastAccessTime.dwLowDateTime=0x5d7c3b20, ftLastAccessTime.dwHighDateTime=0x1d81e96, ftLastWriteTime.dwLowDateTime=0x5d7c3b20, ftLastWriteTime.dwHighDateTime=0x1d81e96, nFileSizeHigh=0x0, nFileSizeLow=0xf2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="hgaKU.odt", cAlternateFileName="")) returned 1
[0149.961] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f402890, ftCreationTime.dwHighDateTime=0x1d7ba24, ftLastAccessTime.dwLowDateTime=0x7255a3c0, ftLastAccessTime.dwHighDateTime=0x1d7ea74, ftLastWriteTime.dwLowDateTime=0x7255a3c0, ftLastWriteTime.dwHighDateTime=0x1d7ea74, nFileSizeHigh=0x0, nFileSizeLow=0xef62, dwReserved0=0x0, dwReserved1=0x0, cFileName="iriH.docx", cAlternateFileName="IRIH~1.DOC")) returned 1
[0149.962] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee2c490, ftCreationTime.dwHighDateTime=0x1d81b1c, ftLastAccessTime.dwLowDateTime=0x3c989e80, ftLastAccessTime.dwHighDateTime=0x1d81fe0, ftLastWriteTime.dwLowDateTime=0x3c989e80, ftLastWriteTime.dwHighDateTime=0x1d81fe0, nFileSizeHigh=0x0, nFileSizeLow=0x454b, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSv2CXAx0sO0nwq3.docx", cAlternateFileName="ISV2CX~1.DOC")) returned 1
[0149.962] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf5fa0, ftCreationTime.dwHighDateTime=0x1d824fe, ftLastAccessTime.dwLowDateTime=0x2639b3f0, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0x2639b3f0, ftLastWriteTime.dwHighDateTime=0x1d82737, nFileSizeHigh=0x0, nFileSizeLow=0x7e53, dwReserved0=0x0, dwReserved1=0x0, cFileName="LXAm.xlsx", cAlternateFileName="LXAM~1.XLS")) returned 1
[0149.962] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927389f0, ftCreationTime.dwHighDateTime=0x1d7a9b1, ftLastAccessTime.dwLowDateTime=0x6cd7edd0, ftLastAccessTime.dwHighDateTime=0x1d7eb15, ftLastWriteTime.dwLowDateTime=0x6cd7edd0, ftLastWriteTime.dwHighDateTime=0x1d7eb15, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LXf5O1UnE8gZ7VPN-X.docx", cAlternateFileName="LXF5O1~1.DOC")) returned 1
[0149.962] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4f2f040, ftCreationTime.dwHighDateTime=0x1d7feac, ftLastAccessTime.dwLowDateTime=0x4744cb10, ftLastAccessTime.dwHighDateTime=0x1d82774, ftLastWriteTime.dwLowDateTime=0x4744cb10, ftLastWriteTime.dwHighDateTime=0x1d82774, nFileSizeHigh=0x0, nFileSizeLow=0x6776, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lxh6PbYU5lGk0.pptx", cAlternateFileName="LXH6PB~1.PPT")) returned 1
[0149.963] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eb80d0, ftCreationTime.dwHighDateTime=0x1d82436, ftLastAccessTime.dwLowDateTime=0x25fb4ab0, ftLastAccessTime.dwHighDateTime=0x1d825df, ftLastWriteTime.dwLowDateTime=0x25fb4ab0, ftLastWriteTime.dwHighDateTime=0x1d825df, nFileSizeHigh=0x0, nFileSizeLow=0x107a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="lyrRYp D-2Z.docx", cAlternateFileName="LYRRYP~1.DOC")) returned 1
[0149.963] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02879f0, ftCreationTime.dwHighDateTime=0x1d826fb, ftLastAccessTime.dwLowDateTime=0xc3865040, ftLastAccessTime.dwHighDateTime=0x1d827ab, ftLastWriteTime.dwLowDateTime=0xc3865040, ftLastWriteTime.dwHighDateTime=0x1d827ab, nFileSizeHigh=0x0, nFileSizeLow=0x13bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNffSwckP FbcIEuI5.doc", cAlternateFileName="MSNFFS~1.DOC")) returned 1
[0149.963] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1
[0149.963] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d374e80, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d374e80, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d374e80, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1
[0149.963] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1
[0149.964] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe55e5d0, ftCreationTime.dwHighDateTime=0x1d81cad, ftLastAccessTime.dwLowDateTime=0xb079e420, ftLastAccessTime.dwHighDateTime=0x1d824d2, ftLastWriteTime.dwLowDateTime=0xb079e420, ftLastWriteTime.dwHighDateTime=0x1d824d2, nFileSizeHigh=0x0, nFileSizeLow=0x3e19, dwReserved0=0x0, dwReserved1=0x0, cFileName="n7hKHIqS.rtf", cAlternateFileName="")) returned 1
[0149.964] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc50c0, ftCreationTime.dwHighDateTime=0x1d819fd, ftLastAccessTime.dwLowDateTime=0x5f903f90, ftLastAccessTime.dwHighDateTime=0x1d81b8c, ftLastWriteTime.dwLowDateTime=0x5f903f90, ftLastWriteTime.dwHighDateTime=0x1d81b8c, nFileSizeHigh=0x0, nFileSizeLow=0xf85f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ocgatxC-6Ez0Hk_y.xls", cAlternateFileName="OCGATX~1.XLS")) returned 1
[0149.964] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x65ef9a5c, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1
[0149.964] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f827a60, ftCreationTime.dwHighDateTime=0x1d81dca, ftLastAccessTime.dwLowDateTime=0x59dd3ca0, ftLastAccessTime.dwHighDateTime=0x1d823df, ftLastWriteTime.dwLowDateTime=0x59dd3ca0, ftLastWriteTime.dwHighDateTime=0x1d823df, nFileSizeHigh=0x0, nFileSizeLow=0xa3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="owF5pa QZMhBD.rtf", cAlternateFileName="OWF5PA~1.RTF")) returned 1
[0149.965] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc572d180, ftCreationTime.dwHighDateTime=0x1d8296d, ftLastAccessTime.dwLowDateTime=0x9b0dd40, ftLastAccessTime.dwHighDateTime=0x1d829f2, ftLastWriteTime.dwLowDateTime=0x9b0dd40, ftLastWriteTime.dwHighDateTime=0x1d829f2, nFileSizeHigh=0x0, nFileSizeLow=0x4953, dwReserved0=0x0, dwReserved1=0x0, cFileName="p9uL--tRL_6UnNWprC.odt", cAlternateFileName="P9UL--~1.ODT")) returned 1
[0149.965] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc60980, ftCreationTime.dwHighDateTime=0x1d829a0, ftLastAccessTime.dwLowDateTime=0xa1794260, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0xa1794260, ftLastWriteTime.dwHighDateTime=0x1d829f3, nFileSizeHigh=0x0, nFileSizeLow=0x12344, dwReserved0=0x0, dwReserved1=0x0, cFileName="pSJLpn8DrUrz1-Xy6Fw_.pdf", cAlternateFileName="PSJLPN~1.PDF")) returned 1
[0149.966] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6810580, ftCreationTime.dwHighDateTime=0x1d819e3, ftLastAccessTime.dwLowDateTime=0x3c8de40, ftLastAccessTime.dwHighDateTime=0x1d81ed6, ftLastWriteTime.dwLowDateTime=0x3c8de40, ftLastWriteTime.dwHighDateTime=0x1d81ed6, nFileSizeHigh=0x0, nFileSizeLow=0x10b71, dwReserved0=0x0, dwReserved1=0x0, cFileName="q9j2C2vhqGqT8Y.xls", cAlternateFileName="Q9J2C2~1.XLS")) returned 1
[0149.966] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8100020, ftCreationTime.dwHighDateTime=0x1d81323, ftLastAccessTime.dwLowDateTime=0x5835a220, ftLastAccessTime.dwHighDateTime=0x1d821a5, ftLastWriteTime.dwLowDateTime=0x5835a220, ftLastWriteTime.dwHighDateTime=0x1d821a5, nFileSizeHigh=0x0, nFileSizeLow=0x1160, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qi06Dg7iSL hMONv94Db.xlsx", cAlternateFileName="QI06DG~1.XLS")) returned 1
[0149.966] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31a5460, ftCreationTime.dwHighDateTime=0x1d8274a, ftLastAccessTime.dwLowDateTime=0x744511a0, ftLastAccessTime.dwHighDateTime=0x1d82883, ftLastWriteTime.dwLowDateTime=0x744511a0, ftLastWriteTime.dwHighDateTime=0x1d82883, nFileSizeHigh=0x0, nFileSizeLow=0x11ef1, dwReserved0=0x0, dwReserved1=0x0, cFileName="QqWlqDBqRFVAm vqX4DG.pdf", cAlternateFileName="QQWLQD~1.PDF")) returned 1
[0149.966] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38867ac0, ftCreationTime.dwHighDateTime=0x1d827b9, ftLastAccessTime.dwLowDateTime=0x342424e0, ftLastAccessTime.dwHighDateTime=0x1d82823, ftLastWriteTime.dwLowDateTime=0x342424e0, ftLastWriteTime.dwHighDateTime=0x1d82823, nFileSizeHigh=0x0, nFileSizeLow=0x8e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="r6Cg4NKEaRK.ots", cAlternateFileName="R6CG4N~1.OTS")) returned 1
[0149.967] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d63a50, ftCreationTime.dwHighDateTime=0x1d81e3b, ftLastAccessTime.dwLowDateTime=0x72d93c00, ftLastAccessTime.dwHighDateTime=0x1d82988, ftLastWriteTime.dwLowDateTime=0x72d93c00, ftLastWriteTime.dwHighDateTime=0x1d82988, nFileSizeHigh=0x0, nFileSizeLow=0xcfc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="TDG1tR6SD8R 70ytf.docx", cAlternateFileName="TDG1TR~1.DOC")) returned 1
[0149.967] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53efdbf0, ftCreationTime.dwHighDateTime=0x1d821c2, ftLastAccessTime.dwLowDateTime=0x74932200, ftLastAccessTime.dwHighDateTime=0x1d8270c, ftLastWriteTime.dwLowDateTime=0x74932200, ftLastWriteTime.dwHighDateTime=0x1d8270c, nFileSizeHigh=0x0, nFileSizeLow=0x57f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="uhTnuhWyZPoex.pdf", cAlternateFileName="UHTNUH~1.PDF")) returned 1
[0149.967] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6982eec0, ftCreationTime.dwHighDateTime=0x1d7bba7, ftLastAccessTime.dwLowDateTime=0xbbf9d860, ftLastAccessTime.dwHighDateTime=0x1d7d567, ftLastWriteTime.dwLowDateTime=0xbbf9d860, ftLastWriteTime.dwHighDateTime=0x1d7d567, nFileSizeHigh=0x0, nFileSizeLow=0x5c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="uIwqDmYW8Ql.docx", cAlternateFileName="UIWQDM~1.DOC")) returned 1
[0149.968] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdba143d0, ftCreationTime.dwHighDateTime=0x1d81ec1, ftLastAccessTime.dwLowDateTime=0x1494afb0, ftLastAccessTime.dwHighDateTime=0x1d8202f, ftLastWriteTime.dwLowDateTime=0x1494afb0, ftLastWriteTime.dwHighDateTime=0x1d8202f, nFileSizeHigh=0x0, nFileSizeLow=0x17d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcYEH.doc", cAlternateFileName="")) returned 1
[0149.968] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c075f0, ftCreationTime.dwHighDateTime=0x1d7dd97, ftLastAccessTime.dwLowDateTime=0x3bac3590, ftLastAccessTime.dwHighDateTime=0x1d81aa4, ftLastWriteTime.dwLowDateTime=0x3bac3590, ftLastWriteTime.dwHighDateTime=0x1d81aa4, nFileSizeHigh=0x0, nFileSizeLow=0x79d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="wlZTxESTUgU f3.xlsx", cAlternateFileName="WLZTXE~1.XLS")) returned 1
[0149.968] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61beb0, ftCreationTime.dwHighDateTime=0x1d81aa5, ftLastAccessTime.dwLowDateTime=0x48b00210, ftLastAccessTime.dwHighDateTime=0x1d823ca, ftLastWriteTime.dwLowDateTime=0x48b00210, ftLastWriteTime.dwHighDateTime=0x1d823ca, nFileSizeHigh=0x0, nFileSizeLow=0x16363, dwReserved0=0x0, dwReserved1=0x0, cFileName="WU7S.xls", cAlternateFileName="")) returned 1
[0149.968] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x199007f0, ftCreationTime.dwHighDateTime=0x1d8218b, ftLastAccessTime.dwLowDateTime=0x3e7a2700, ftLastAccessTime.dwHighDateTime=0x1d826f7, ftLastWriteTime.dwLowDateTime=0x3e7a2700, ftLastWriteTime.dwHighDateTime=0x1d826f7, nFileSizeHigh=0x0, nFileSizeLow=0x7e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="wVE9flHzacBjM.pptx", cAlternateFileName="WVE9FL~1.PPT")) returned 1
[0149.969] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148e4700, ftCreationTime.dwHighDateTime=0x1d7e3ea, ftLastAccessTime.dwLowDateTime=0xbefc52e0, ftLastAccessTime.dwHighDateTime=0x1d819d7, ftLastWriteTime.dwLowDateTime=0xbefc52e0, ftLastWriteTime.dwHighDateTime=0x1d819d7, nFileSizeHigh=0x0, nFileSizeLow=0x5a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="y8TckRi KxxqHv9oqq.xlsx", cAlternateFileName="Y8TCKR~1.XLS")) returned 1
[0149.969] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc5da00, ftCreationTime.dwHighDateTime=0x1d7d439, ftLastAccessTime.dwLowDateTime=0xc0d81010, ftLastAccessTime.dwHighDateTime=0x1d7f1bc, ftLastWriteTime.dwLowDateTime=0xc0d81010, ftLastWriteTime.dwHighDateTime=0x1d7f1bc, nFileSizeHigh=0x0, nFileSizeLow=0x17858, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZJRfdPfcL.xlsx", cAlternateFileName="ZJRFDP~1.XLS")) returned 1
[0149.969] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd083fcf0, ftCreationTime.dwHighDateTime=0x1d823c5, ftLastAccessTime.dwLowDateTime=0x7d735750, ftLastAccessTime.dwHighDateTime=0x1d8240f, ftLastWriteTime.dwLowDateTime=0x7d735750, ftLastWriteTime.dwHighDateTime=0x1d8240f, nFileSizeHigh=0x0, nFileSizeLow=0x16987, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZWAFqo.pps", cAlternateFileName="")) returned 1
[0149.969] FindNextFileW (in: hFindFile=0x690ae0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd083fcf0, ftCreationTime.dwHighDateTime=0x1d823c5, ftLastAccessTime.dwLowDateTime=0x7d735750, ftLastAccessTime.dwHighDateTime=0x1d8240f, ftLastWriteTime.dwLowDateTime=0x7d735750, ftLastWriteTime.dwHighDateTime=0x1d8240f, nFileSizeHigh=0x0, nFileSizeLow=0x16987, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZWAFqo.pps", cAlternateFileName="")) returned 0
[0149.970] FindClose (in: hFindFile=0x690ae0 | out: hFindFile=0x690ae0) returned 1
[0149.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1
[0149.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1
[0149.970] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", lpFilePart=0x0) returned 0x37
[0149.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0149.970] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0tvbm_qdd3tvo2za_6p.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0149.971] GetFileType (hFile=0x34c) returned 0x1
[0149.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0149.971] GetFileType (hFile=0x34c) returned 0x1
[0149.971] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xb923
[0149.971] ReadFile (in: hFile=0x34c, lpBuffer=0x238eb2c, nNumberOfBytesToRead=0xb923, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x238eb2c*, lpNumberOfBytesRead=0x19eeb0*=0xb923, lpOverlapped=0x0) returned 1
[0149.972] CloseHandle (hObject=0x34c) returned 1
[0150.099] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", lpFilePart=0x0) returned 0x37
[0150.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.099] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0tvbm_qdd3tvo2za_6p.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.103] GetFileType (hFile=0x34c) returned 0x1
[0150.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.103] GetFileType (hFile=0x34c) returned 0x1
[0150.103] WriteFile (in: hFile=0x34c, lpBuffer=0x221efe4*, nNumberOfBytesToWrite=0xb930, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x221efe4*, lpNumberOfBytesWritten=0x19eea0*=0xb930, lpOverlapped=0x0) returned 1
[0150.105] CloseHandle (hObject=0x34c) returned 1
[0150.108] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods", lpFilePart=0x0) returned 0x37
[0150.108] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods.coom", lpFilePart=0x0) returned 0x3c
[0150.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.108] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0tvbm_qdd3tvo2za_6p.ods"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1943c5e0, ftCreationTime.dwHighDateTime=0x1d819fa, ftLastAccessTime.dwLowDateTime=0x5f4803e0, ftLastAccessTime.dwHighDateTime=0x1d81b48, ftLastWriteTime.dwLowDateTime=0x1e51704e, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xb930)) returned 1
[0150.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.108] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0tvbm_qdd3tvo2za_6p.ods"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\0tvBM_QdD3TVO2ZA_6P.ods.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\0tvbm_qdd3tvo2za_6p.ods.coom")) returned 1
[0150.109] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", lpFilePart=0x0) returned 0x2f
[0150.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.109] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1gcpcj5ijqw.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.109] GetFileType (hFile=0x34c) returned 0x1
[0150.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.110] GetFileType (hFile=0x34c) returned 0x1
[0150.110] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1835e
[0150.110] ReadFile (in: hFile=0x34c, lpBuffer=0x324b180, nNumberOfBytesToRead=0x1835e, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x324b180*, lpNumberOfBytesRead=0x19eeb0*=0x1835e, lpOverlapped=0x0) returned 1
[0150.111] CloseHandle (hObject=0x34c) returned 1
[0150.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", lpFilePart=0x0) returned 0x2f
[0150.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.134] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1gcpcj5ijqw.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.136] GetFileType (hFile=0x34c) returned 0x1
[0150.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.136] GetFileType (hFile=0x34c) returned 0x1
[0150.136] WriteFile (in: hFile=0x34c, lpBuffer=0x32c42a0*, nNumberOfBytesToWrite=0x18360, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x32c42a0*, lpNumberOfBytesWritten=0x19eea0*=0x18360, lpOverlapped=0x0) returned 1
[0150.141] CloseHandle (hObject=0x34c) returned 1
[0150.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv", lpFilePart=0x0) returned 0x2f
[0150.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv.coom", lpFilePart=0x0) returned 0x34
[0150.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.144] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1gcpcj5ijqw.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8408450, ftCreationTime.dwHighDateTime=0x1d82055, ftLastAccessTime.dwLowDateTime=0x97412920, ftLastAccessTime.dwHighDateTime=0x1d825e8, ftLastWriteTime.dwLowDateTime=0x1e56fdf5, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x18360)) returned 1
[0150.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.145] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1gcpcj5ijqw.csv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1gCPCj5iJQW.csv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1gcpcj5ijqw.csv.coom")) returned 1
[0150.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", lpFilePart=0x0) returned 0x38
[0150.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.146] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1yj7pdeyv0wl_14kuopt.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.146] GetFileType (hFile=0x34c) returned 0x1
[0150.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.146] GetFileType (hFile=0x34c) returned 0x1
[0150.146] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x10457
[0150.146] ReadFile (in: hFile=0x34c, lpBuffer=0x2277f80, nNumberOfBytesToRead=0x10457, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2277f80*, lpNumberOfBytesRead=0x19eeb0*=0x10457, lpOverlapped=0x0) returned 1
[0150.147] CloseHandle (hObject=0x34c) returned 1
[0150.176] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", lpFilePart=0x0) returned 0x38
[0150.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.176] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1yj7pdeyv0wl_14kuopt.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.181] GetFileType (hFile=0x34c) returned 0x1
[0150.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.181] GetFileType (hFile=0x34c) returned 0x1
[0150.181] WriteFile (in: hFile=0x34c, lpBuffer=0x22f5a78*, nNumberOfBytesToWrite=0x10460, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22f5a78*, lpNumberOfBytesWritten=0x19eea0*=0x10460, lpOverlapped=0x0) returned 1
[0150.184] CloseHandle (hObject=0x34c) returned 1
[0150.187] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf", lpFilePart=0x0) returned 0x38
[0150.188] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf.coom", lpFilePart=0x0) returned 0x3d
[0150.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.188] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1yj7pdeyv0wl_14kuopt.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11230f20, ftCreationTime.dwHighDateTime=0x1d81deb, ftLastAccessTime.dwLowDateTime=0x9111cb40, ftLastAccessTime.dwHighDateTime=0x1d8294e, ftLastWriteTime.dwLowDateTime=0x1e5d9291, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x10460)) returned 1
[0150.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.188] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1yj7pdeyv0wl_14kuopt.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\1yj7pDeYv0wl_14KUOPt.rtf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\1yj7pdeyv0wl_14kuopt.rtf.coom")) returned 1
[0150.189] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", lpFilePart=0x0) returned 0x35
[0150.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.189] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\22yzihm7pybi2ow6r.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.189] GetFileType (hFile=0x34c) returned 0x1
[0150.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.190] GetFileType (hFile=0x34c) returned 0x1
[0150.190] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x4f4
[0150.190] ReadFile (in: hFile=0x34c, lpBuffer=0x23067b4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23067b4*, lpNumberOfBytesRead=0x19eeb0*=0x4f4, lpOverlapped=0x0) returned 1
[0150.190] CloseHandle (hObject=0x34c) returned 1
[0150.219] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", lpFilePart=0x0) returned 0x35
[0150.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.219] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\22yzihm7pybi2ow6r.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.221] GetFileType (hFile=0x34c) returned 0x1
[0150.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.221] GetFileType (hFile=0x34c) returned 0x1
[0150.222] WriteFile (in: hFile=0x34c, lpBuffer=0x2355f98*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x19ee74, lpOverlapped=0x0 | out: lpBuffer=0x2355f98*, lpNumberOfBytesWritten=0x19ee74*=0x500, lpOverlapped=0x0) returned 1
[0150.223] CloseHandle (hObject=0x34c) returned 1
[0150.224] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf", lpFilePart=0x0) returned 0x35
[0150.224] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf.coom", lpFilePart=0x0) returned 0x3a
[0150.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.224] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\22yzihm7pybi2ow6r.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1db8ab0, ftCreationTime.dwHighDateTime=0x1d81a84, ftLastAccessTime.dwLowDateTime=0xfb521090, ftLastAccessTime.dwHighDateTime=0x1d8290e, ftLastWriteTime.dwLowDateTime=0x1e6332c8, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1
[0150.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.225] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\22yzihm7pybi2ow6r.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\22yziHM7PYbi2OW6R.pdf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\22yzihm7pybi2ow6r.pdf.coom")) returned 1
[0150.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", lpFilePart=0x0) returned 0x2a
[0150.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.226] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2qxtt.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.226] GetFileType (hFile=0x34c) returned 0x1
[0150.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.226] GetFileType (hFile=0x34c) returned 0x1
[0150.226] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xd31d
[0150.226] ReadFile (in: hFile=0x34c, lpBuffer=0x2357220, nNumberOfBytesToRead=0xd31d, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2357220*, lpNumberOfBytesRead=0x19eeb0*=0xd31d, lpOverlapped=0x0) returned 1
[0150.228] CloseHandle (hObject=0x34c) returned 1
[0150.261] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", lpFilePart=0x0) returned 0x2a
[0150.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.262] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2qxtt.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.264] GetFileType (hFile=0x34c) returned 0x1
[0150.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.264] GetFileType (hFile=0x34c) returned 0x1
[0150.264] WriteFile (in: hFile=0x34c, lpBuffer=0x23cb958*, nNumberOfBytesToWrite=0xd320, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23cb958*, lpNumberOfBytesWritten=0x19eea0*=0xd320, lpOverlapped=0x0) returned 1
[0150.266] CloseHandle (hObject=0x34c) returned 1
[0150.269] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx", lpFilePart=0x0) returned 0x2a
[0150.269] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx.coom", lpFilePart=0x0) returned 0x2f
[0150.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.270] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2qxtt.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a472260, ftCreationTime.dwHighDateTime=0x1d7c456, ftLastAccessTime.dwLowDateTime=0x2e7ac760, ftLastAccessTime.dwHighDateTime=0x1d7d48b, ftLastWriteTime.dwLowDateTime=0x1e6a1044, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xd320)) returned 1
[0150.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.270] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2qxtt.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\2qxTT.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\2qxtt.pptx.coom")) returned 1
[0150.271] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", lpFilePart=0x0) returned 0x32
[0150.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.271] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3whrrlh-2tuje8.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.271] GetFileType (hFile=0x34c) returned 0x1
[0150.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.272] GetFileType (hFile=0x34c) returned 0x1
[0150.272] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x9ed1
[0150.272] ReadFile (in: hFile=0x34c, lpBuffer=0x23d8fc0, nNumberOfBytesToRead=0x9ed1, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23d8fc0*, lpNumberOfBytesRead=0x19eeb0*=0x9ed1, lpOverlapped=0x0) returned 1
[0150.272] CloseHandle (hObject=0x34c) returned 1
[0150.345] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", lpFilePart=0x0) returned 0x32
[0150.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.346] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3whrrlh-2tuje8.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.348] GetFileType (hFile=0x34c) returned 0x1
[0150.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.348] GetFileType (hFile=0x34c) returned 0x1
[0150.348] WriteFile (in: hFile=0x34c, lpBuffer=0x24577e4*, nNumberOfBytesToWrite=0x9ee0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x24577e4*, lpNumberOfBytesWritten=0x19eea0*=0x9ee0, lpOverlapped=0x0) returned 1
[0150.350] CloseHandle (hObject=0x34c) returned 1
[0150.353] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc", lpFilePart=0x0) returned 0x32
[0150.353] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc.coom", lpFilePart=0x0) returned 0x37
[0150.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.353] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3whrrlh-2tuje8.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d86690, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0x4418c370, ftLastAccessTime.dwHighDateTime=0x1d826fb, ftLastWriteTime.dwLowDateTime=0x1e76dd67, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x9ee0)) returned 1
[0150.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.354] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3whrrlh-2tuje8.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\3wHRRlh-2tUJE8.doc.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\3whrrlh-2tuje8.doc.coom")) returned 1
[0150.355] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", lpFilePart=0x0) returned 0x29
[0150.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.355] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5byo.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.355] GetFileType (hFile=0x34c) returned 0x1
[0150.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.355] GetFileType (hFile=0x34c) returned 0x1
[0150.355] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1751b
[0150.356] ReadFile (in: hFile=0x34c, lpBuffer=0x3317520, nNumberOfBytesToRead=0x1751b, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3317520*, lpNumberOfBytesRead=0x19eeb0*=0x1751b, lpOverlapped=0x0) returned 1
[0150.357] CloseHandle (hObject=0x34c) returned 1
[0150.450] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", lpFilePart=0x0) returned 0x29
[0150.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.450] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5byo.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.453] GetFileType (hFile=0x34c) returned 0x1
[0150.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.453] GetFileType (hFile=0x34c) returned 0x1
[0150.453] WriteFile (in: hFile=0x34c, lpBuffer=0x338bef8*, nNumberOfBytesToWrite=0x17520, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x338bef8*, lpNumberOfBytesWritten=0x19eea0*=0x17520, lpOverlapped=0x0) returned 1
[0150.457] CloseHandle (hObject=0x34c) returned 1
[0150.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx", lpFilePart=0x0) returned 0x29
[0150.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx.coom", lpFilePart=0x0) returned 0x2e
[0150.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5byo.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f4c480, ftCreationTime.dwHighDateTime=0x1d8299f, ftLastAccessTime.dwLowDateTime=0xa3827650, ftLastAccessTime.dwHighDateTime=0x1d829e7, ftLastWriteTime.dwLowDateTime=0x1e87733f, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17520)) returned 1
[0150.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.462] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5byo.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\5BYO.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\5byo.pptx.coom")) returned 1
[0150.464] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", lpFilePart=0x0) returned 0x34
[0150.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.464] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6_8c7suq3sh2zdvr.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.465] GetFileType (hFile=0x34c) returned 0x1
[0150.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.465] GetFileType (hFile=0x34c) returned 0x1
[0150.465] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x4dca
[0150.465] ReadFile (in: hFile=0x34c, lpBuffer=0x2229228, nNumberOfBytesToRead=0x4dca, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2229228*, lpNumberOfBytesRead=0x19eeb0*=0x4dca, lpOverlapped=0x0) returned 1
[0150.466] CloseHandle (hObject=0x34c) returned 1
[0150.487] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", lpFilePart=0x0) returned 0x34
[0150.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.487] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6_8c7suq3sh2zdvr.ppt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.489] GetFileType (hFile=0x34c) returned 0x1
[0150.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.489] GetFileType (hFile=0x34c) returned 0x1
[0150.489] WriteFile (in: hFile=0x34c, lpBuffer=0x228e658*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x228e658*, lpNumberOfBytesWritten=0x19eea0*=0x4dd0, lpOverlapped=0x0) returned 1
[0150.491] CloseHandle (hObject=0x34c) returned 1
[0150.493] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt", lpFilePart=0x0) returned 0x34
[0150.493] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt.coom", lpFilePart=0x0) returned 0x39
[0150.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6_8c7suq3sh2zdvr.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x316d7680, ftCreationTime.dwHighDateTime=0x1d82066, ftLastAccessTime.dwLowDateTime=0x2ca42980, ftLastAccessTime.dwHighDateTime=0x1d82496, ftLastWriteTime.dwLowDateTime=0x1e8c2def, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x4dd0)) returned 1
[0150.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.493] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6_8c7suq3sh2zdvr.ppt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\6_8C7Suq3sh2Zdvr.ppt.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\6_8c7suq3sh2zdvr.ppt.coom")) returned 1
[0150.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", lpFilePart=0x0) returned 0x38
[0150.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.494] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7avztg3coejywumxszt.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.494] GetFileType (hFile=0x34c) returned 0x1
[0150.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.495] GetFileType (hFile=0x34c) returned 0x1
[0150.495] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xaeac
[0150.495] ReadFile (in: hFile=0x34c, lpBuffer=0x22937ec, nNumberOfBytesToRead=0xaeac, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22937ec*, lpNumberOfBytesRead=0x19eeb0*=0xaeac, lpOverlapped=0x0) returned 1
[0150.496] CloseHandle (hObject=0x34c) returned 1
[0150.517] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", lpFilePart=0x0) returned 0x38
[0150.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.517] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7avztg3coejywumxszt.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.519] GetFileType (hFile=0x34c) returned 0x1
[0150.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.519] GetFileType (hFile=0x34c) returned 0x1
[0150.519] WriteFile (in: hFile=0x34c, lpBuffer=0x23011d0*, nNumberOfBytesToWrite=0xaeb0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23011d0*, lpNumberOfBytesWritten=0x19eea0*=0xaeb0, lpOverlapped=0x0) returned 1
[0150.521] CloseHandle (hObject=0x34c) returned 1
[0150.525] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx", lpFilePart=0x0) returned 0x38
[0150.525] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx.coom", lpFilePart=0x0) returned 0x3d
[0150.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.525] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7avztg3coejywumxszt.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8970c0, ftCreationTime.dwHighDateTime=0x1d808ba, ftLastAccessTime.dwLowDateTime=0xd3c996e0, ftLastAccessTime.dwHighDateTime=0x1d80c5f, ftLastWriteTime.dwLowDateTime=0x1e91021d, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xaeb0)) returned 1
[0150.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.525] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7avztg3coejywumxszt.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\7AVZTG3CoeJywumxSZt.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\7avztg3coejywumxszt.docx.coom")) returned 1
[0150.526] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", lpFilePart=0x0) returned 0x32
[0150.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.526] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\998wb55hd8qlh4.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.526] GetFileType (hFile=0x34c) returned 0x1
[0150.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.526] GetFileType (hFile=0x34c) returned 0x1
[0150.526] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xba63
[0150.526] ReadFile (in: hFile=0x34c, lpBuffer=0x230c454, nNumberOfBytesToRead=0xba63, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x230c454*, lpNumberOfBytesRead=0x19eeb0*=0xba63, lpOverlapped=0x0) returned 1
[0150.527] CloseHandle (hObject=0x34c) returned 1
[0150.550] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", lpFilePart=0x0) returned 0x32
[0150.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.550] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\998wb55hd8qlh4.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.551] GetFileType (hFile=0x34c) returned 0x1
[0150.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.551] GetFileType (hFile=0x34c) returned 0x1
[0150.551] WriteFile (in: hFile=0x34c, lpBuffer=0x237c17c*, nNumberOfBytesToWrite=0xba70, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x237c17c*, lpNumberOfBytesWritten=0x19eea0*=0xba70, lpOverlapped=0x0) returned 1
[0150.554] CloseHandle (hObject=0x34c) returned 1
[0150.557] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls", lpFilePart=0x0) returned 0x32
[0150.557] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls.coom", lpFilePart=0x0) returned 0x37
[0150.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.557] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\998wb55hd8qlh4.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c31240, ftCreationTime.dwHighDateTime=0x1d81e5a, ftLastAccessTime.dwLowDateTime=0xc96b5a10, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0x1e95e879, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xba70)) returned 1
[0150.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.557] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\998wb55hd8qlh4.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\998Wb55hD8qLh4.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\998wb55hd8qlh4.xls.coom")) returned 1
[0150.558] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", lpFilePart=0x0) returned 0x34
[0150.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.558] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a0kagtxvhzrgl2nu.ods"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.558] GetFileType (hFile=0x34c) returned 0x1
[0150.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.558] GetFileType (hFile=0x34c) returned 0x1
[0150.558] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x17d16
[0150.558] ReadFile (in: hFile=0x34c, lpBuffer=0x33d0678, nNumberOfBytesToRead=0x17d16, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x33d0678*, lpNumberOfBytesRead=0x19eeb0*=0x17d16, lpOverlapped=0x0) returned 1
[0150.559] CloseHandle (hObject=0x34c) returned 1
[0150.585] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", lpFilePart=0x0) returned 0x34
[0150.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.586] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a0kagtxvhzrgl2nu.ods"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.588] GetFileType (hFile=0x34c) returned 0x1
[0150.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.588] GetFileType (hFile=0x34c) returned 0x1
[0150.588] WriteFile (in: hFile=0x34c, lpBuffer=0x3447850*, nNumberOfBytesToWrite=0x17d20, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3447850*, lpNumberOfBytesWritten=0x19eea0*=0x17d20, lpOverlapped=0x0) returned 1
[0150.591] CloseHandle (hObject=0x34c) returned 1
[0150.595] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods", lpFilePart=0x0) returned 0x34
[0150.595] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods.coom", lpFilePart=0x0) returned 0x39
[0150.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.595] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a0kagtxvhzrgl2nu.ods"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77eb4ff0, ftCreationTime.dwHighDateTime=0x1d81a22, ftLastAccessTime.dwLowDateTime=0xc802c340, ftLastAccessTime.dwHighDateTime=0x1d81f3d, ftLastWriteTime.dwLowDateTime=0x1e9bbf54, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17d20)) returned 1
[0150.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.596] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a0kagtxvhzrgl2nu.ods"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\A0KaGTxVHzRgl2NU.ods.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\a0kagtxvhzrgl2nu.ods.coom")) returned 1
[0150.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", lpFilePart=0x0) returned 0x37
[0150.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.596] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ai3doif_i6aorcouoq.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.597] GetFileType (hFile=0x34c) returned 0x1
[0150.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.597] GetFileType (hFile=0x34c) returned 0x1
[0150.597] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xbdde
[0150.597] ReadFile (in: hFile=0x34c, lpBuffer=0x23d5118, nNumberOfBytesToRead=0xbdde, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23d5118*, lpNumberOfBytesRead=0x19eeb0*=0xbdde, lpOverlapped=0x0) returned 1
[0150.599] CloseHandle (hObject=0x34c) returned 1
[0150.658] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", lpFilePart=0x0) returned 0x37
[0150.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.658] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ai3doif_i6aorcouoq.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.659] GetFileType (hFile=0x34c) returned 0x1
[0150.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.660] GetFileType (hFile=0x34c) returned 0x1
[0150.660] WriteFile (in: hFile=0x34c, lpBuffer=0x225167c*, nNumberOfBytesToWrite=0xbde0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x225167c*, lpNumberOfBytesWritten=0x19eea0*=0xbde0, lpOverlapped=0x0) returned 1
[0150.661] CloseHandle (hObject=0x34c) returned 1
[0150.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx", lpFilePart=0x0) returned 0x37
[0150.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx.coom", lpFilePart=0x0) returned 0x3c
[0150.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ai3doif_i6aorcouoq.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e388c50, ftCreationTime.dwHighDateTime=0x1d8230e, ftLastAccessTime.dwLowDateTime=0xb9f606f0, ftLastAccessTime.dwHighDateTime=0x1d8290a, ftLastWriteTime.dwLowDateTime=0x1ea64158, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xbde0)) returned 1
[0150.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.664] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ai3doif_i6aorcouoq.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Ai3doif_i6aorCOuoq.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ai3doif_i6aorcouoq.docx.coom")) returned 1
[0150.665] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", lpFilePart=0x0) returned 0x35
[0150.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.665] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cj6k_ys9jtdntnd8.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.666] GetFileType (hFile=0x34c) returned 0x1
[0150.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.666] GetFileType (hFile=0x34c) returned 0x1
[0150.666] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x178c5
[0150.666] ReadFile (in: hFile=0x34c, lpBuffer=0x3477150, nNumberOfBytesToRead=0x178c5, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3477150*, lpNumberOfBytesRead=0x19eeb0*=0x178c5, lpOverlapped=0x0) returned 1
[0150.667] CloseHandle (hObject=0x34c) returned 1
[0150.698] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", lpFilePart=0x0) returned 0x35
[0150.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.698] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cj6k_ys9jtdntnd8.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.700] GetFileType (hFile=0x34c) returned 0x1
[0150.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.700] GetFileType (hFile=0x34c) returned 0x1
[0150.700] WriteFile (in: hFile=0x34c, lpBuffer=0x31e1e50*, nNumberOfBytesToWrite=0x178d0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x31e1e50*, lpNumberOfBytesWritten=0x19eea0*=0x178d0, lpOverlapped=0x0) returned 1
[0150.704] CloseHandle (hObject=0x34c) returned 1
[0150.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx", lpFilePart=0x0) returned 0x35
[0150.708] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx.coom", lpFilePart=0x0) returned 0x3a
[0150.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.708] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cj6k_ys9jtdntnd8.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f3e0b0, ftCreationTime.dwHighDateTime=0x1d82304, ftLastAccessTime.dwLowDateTime=0x92fdc3e0, ftLastAccessTime.dwHighDateTime=0x1d82779, ftLastWriteTime.dwLowDateTime=0x1ead0b8a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x178d0)) returned 1
[0150.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.709] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cj6k_ys9jtdntnd8.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\cJ6K_Ys9JTdNtND8.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\cj6k_ys9jtdntnd8.xlsx.coom")) returned 1
[0150.709] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", lpFilePart=0x0) returned 0x37
[0150.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.709] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dkbw3ckgm uf2smdxz.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.710] GetFileType (hFile=0x34c) returned 0x1
[0150.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.710] GetFileType (hFile=0x34c) returned 0x1
[0150.710] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x15a24
[0150.710] ReadFile (in: hFile=0x34c, lpBuffer=0x31f9740, nNumberOfBytesToRead=0x15a24, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x31f9740*, lpNumberOfBytesRead=0x19eeb0*=0x15a24, lpOverlapped=0x0) returned 1
[0150.711] CloseHandle (hObject=0x34c) returned 1
[0150.771] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", lpFilePart=0x0) returned 0x37
[0150.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.772] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dkbw3ckgm uf2smdxz.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.773] GetFileType (hFile=0x34c) returned 0x1
[0150.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.774] GetFileType (hFile=0x34c) returned 0x1
[0150.774] WriteFile (in: hFile=0x34c, lpBuffer=0x3265a60*, nNumberOfBytesToWrite=0x15a30, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3265a60*, lpNumberOfBytesWritten=0x19eea0*=0x15a30, lpOverlapped=0x0) returned 1
[0150.776] CloseHandle (hObject=0x34c) returned 1
[0150.780] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx", lpFilePart=0x0) returned 0x37
[0150.780] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx.coom", lpFilePart=0x0) returned 0x3c
[0150.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.780] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dkbw3ckgm uf2smdxz.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650ad7f0, ftCreationTime.dwHighDateTime=0x1d7fad0, ftLastAccessTime.dwLowDateTime=0xa78efc20, ftLastAccessTime.dwHighDateTime=0x1d7fafb, ftLastWriteTime.dwLowDateTime=0x1eb8014e, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x15a30)) returned 1
[0150.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.781] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dkbw3ckgm uf2smdxz.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\DkBw3ckGM uF2SMdXz.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dkbw3ckgm uf2smdxz.pptx.coom")) returned 1
[0150.782] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", lpFilePart=0x0) returned 0x2d
[0150.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.782] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dxzsj7_sq.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.783] GetFileType (hFile=0x34c) returned 0x1
[0150.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.783] GetFileType (hFile=0x34c) returned 0x1
[0150.783] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x184fc
[0150.783] ReadFile (in: hFile=0x34c, lpBuffer=0x327b4b0, nNumberOfBytesToRead=0x184fc, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x327b4b0*, lpNumberOfBytesRead=0x19eeb0*=0x184fc, lpOverlapped=0x0) returned 1
[0150.784] CloseHandle (hObject=0x34c) returned 1
[0150.809] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", lpFilePart=0x0) returned 0x2d
[0150.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.809] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dxzsj7_sq.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.811] GetFileType (hFile=0x34c) returned 0x1
[0150.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.812] GetFileType (hFile=0x34c) returned 0x1
[0150.812] WriteFile (in: hFile=0x34c, lpBuffer=0x32f4de8*, nNumberOfBytesToWrite=0x18500, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x32f4de8*, lpNumberOfBytesWritten=0x19eea0*=0x18500, lpOverlapped=0x0) returned 1
[0150.814] CloseHandle (hObject=0x34c) returned 1
[0150.818] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf", lpFilePart=0x0) returned 0x2d
[0150.818] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf.coom", lpFilePart=0x0) returned 0x32
[0150.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.818] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dxzsj7_sq.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b23a4f0, ftCreationTime.dwHighDateTime=0x1d82157, ftLastAccessTime.dwLowDateTime=0x1ca905c0, ftLastAccessTime.dwHighDateTime=0x1d82412, ftLastWriteTime.dwLowDateTime=0x1ebdbeef, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x18500)) returned 1
[0150.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.818] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dxzsj7_sq.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\dXzsJ7_sQ.rtf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\dxzsj7_sq.rtf.coom")) returned 1
[0150.834] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", lpFilePart=0x0) returned 0x31
[0150.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.834] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fgtsnob7ndvo.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.835] GetFileType (hFile=0x34c) returned 0x1
[0150.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.835] GetFileType (hFile=0x34c) returned 0x1
[0150.835] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x3aa2
[0150.835] ReadFile (in: hFile=0x34c, lpBuffer=0x2273bf4, nNumberOfBytesToRead=0x3aa2, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2273bf4*, lpNumberOfBytesRead=0x19eeb0*=0x3aa2, lpOverlapped=0x0) returned 1
[0150.835] CloseHandle (hObject=0x34c) returned 1
[0150.866] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", lpFilePart=0x0) returned 0x31
[0150.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.866] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fgtsnob7ndvo.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.869] GetFileType (hFile=0x34c) returned 0x1
[0150.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.869] GetFileType (hFile=0x34c) returned 0x1
[0150.869] WriteFile (in: hFile=0x34c, lpBuffer=0x22d2f28*, nNumberOfBytesToWrite=0x3ab0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22d2f28*, lpNumberOfBytesWritten=0x19eea0*=0x3ab0, lpOverlapped=0x0) returned 1
[0150.873] CloseHandle (hObject=0x34c) returned 1
[0150.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx", lpFilePart=0x0) returned 0x31
[0150.875] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx.coom", lpFilePart=0x0) returned 0x36
[0150.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fgtsnob7ndvo.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaafcff60, ftCreationTime.dwHighDateTime=0x1d79da9, ftLastAccessTime.dwLowDateTime=0x28a85380, ftLastAccessTime.dwHighDateTime=0x1d7d8d6, ftLastWriteTime.dwLowDateTime=0x1ec6812c, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x3ab0)) returned 1
[0150.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.876] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fgtsnob7ndvo.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FgTsNOb7Ndvo.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fgtsnob7ndvo.xlsx.coom")) returned 1
[0150.876] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", lpFilePart=0x0) returned 0x31
[0150.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.877] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fie7zb85t8b-.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.877] GetFileType (hFile=0x34c) returned 0x1
[0150.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.877] GetFileType (hFile=0x34c) returned 0x1
[0150.877] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x18249
[0150.877] ReadFile (in: hFile=0x34c, lpBuffer=0x330d308, nNumberOfBytesToRead=0x18249, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x330d308*, lpNumberOfBytesRead=0x19eeb0*=0x18249, lpOverlapped=0x0) returned 1
[0150.879] CloseHandle (hObject=0x34c) returned 1
[0150.914] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", lpFilePart=0x0) returned 0x31
[0150.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0150.914] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fie7zb85t8b-.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.917] GetFileType (hFile=0x34c) returned 0x1
[0150.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0150.917] GetFileType (hFile=0x34c) returned 0x1
[0150.917] WriteFile (in: hFile=0x34c, lpBuffer=0x3385ed0*, nNumberOfBytesToWrite=0x18250, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3385ed0*, lpNumberOfBytesWritten=0x19eea0*=0x18250, lpOverlapped=0x0) returned 1
[0150.927] CloseHandle (hObject=0x34c) returned 1
[0150.932] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx", lpFilePart=0x0) returned 0x31
[0150.932] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx.coom", lpFilePart=0x0) returned 0x36
[0150.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0150.932] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fie7zb85t8b-.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeafe250, ftCreationTime.dwHighDateTime=0x1d7fd14, ftLastAccessTime.dwLowDateTime=0xbc177e80, ftLastAccessTime.dwHighDateTime=0x1d81e21, ftLastWriteTime.dwLowDateTime=0x1ecf1be9, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x18250)) returned 1
[0150.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0150.932] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fie7zb85t8b-.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\fiE7zb85t8B-.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fie7zb85t8b-.pptx.coom")) returned 1
[0150.933] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", lpFilePart=0x0) returned 0x33
[0150.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0150.933] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fxtu7tjgkarcut.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0150.944] GetFileType (hFile=0x34c) returned 0x1
[0150.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0150.944] GetFileType (hFile=0x34c) returned 0x1
[0150.944] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x14e20
[0150.944] ReadFile (in: hFile=0x34c, lpBuffer=0x339e140, nNumberOfBytesToRead=0x14e20, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x339e140*, lpNumberOfBytesRead=0x19eeb0*=0x14e20, lpOverlapped=0x0) returned 1
[0150.946] CloseHandle (hObject=0x34c) returned 1
[0151.049] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", lpFilePart=0x0) returned 0x33
[0151.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.050] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fxtu7tjgkarcut.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.052] GetFileType (hFile=0x34c) returned 0x1
[0151.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.052] GetFileType (hFile=0x34c) returned 0x1
[0151.052] WriteFile (in: hFile=0x34c, lpBuffer=0x3406860*, nNumberOfBytesToWrite=0x14e30, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3406860*, lpNumberOfBytesWritten=0x19eea0*=0x14e30, lpOverlapped=0x0) returned 1
[0151.056] CloseHandle (hObject=0x34c) returned 1
[0151.070] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx", lpFilePart=0x0) returned 0x33
[0151.070] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx.coom", lpFilePart=0x0) returned 0x38
[0151.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.070] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fxtu7tjgkarcut.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb79abd10, ftCreationTime.dwHighDateTime=0x1d8209f, ftLastAccessTime.dwLowDateTime=0x2f5d36e0, ftLastAccessTime.dwHighDateTime=0x1d82837, ftLastWriteTime.dwLowDateTime=0x1ee43bc6, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x14e30)) returned 1
[0151.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.070] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fxtu7tjgkarcut.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\FXtU7tJGkArCUt.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\fxtu7tjgkarcut.pptx.coom")) returned 1
[0151.072] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", lpFilePart=0x0) returned 0x28
[0151.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.073] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gxt7.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.073] GetFileType (hFile=0x34c) returned 0x1
[0151.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.073] GetFileType (hFile=0x34c) returned 0x1
[0151.073] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x5c48
[0151.073] ReadFile (in: hFile=0x34c, lpBuffer=0x2371000, nNumberOfBytesToRead=0x5c48, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2371000*, lpNumberOfBytesRead=0x19eeb0*=0x5c48, lpOverlapped=0x0) returned 1
[0151.074] CloseHandle (hObject=0x34c) returned 1
[0151.100] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", lpFilePart=0x0) returned 0x28
[0151.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.100] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gxt7.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.102] GetFileType (hFile=0x34c) returned 0x1
[0151.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.102] GetFileType (hFile=0x34c) returned 0x1
[0151.102] WriteFile (in: hFile=0x34c, lpBuffer=0x21e4e64*, nNumberOfBytesToWrite=0x5c50, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x21e4e64*, lpNumberOfBytesWritten=0x19eea0*=0x5c50, lpOverlapped=0x0) returned 1
[0151.104] CloseHandle (hObject=0x34c) returned 1
[0151.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf", lpFilePart=0x0) returned 0x28
[0151.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf.coom", lpFilePart=0x0) returned 0x2d
[0151.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.107] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gxt7.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a84d640, ftCreationTime.dwHighDateTime=0x1d81dbc, ftLastAccessTime.dwLowDateTime=0x5c6943a0, ftLastAccessTime.dwHighDateTime=0x1d826dd, ftLastWriteTime.dwLowDateTime=0x1ee9dd91, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x5c50)) returned 1
[0151.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.107] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gxt7.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Gxt7.rtf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\gxt7.rtf.coom")) returned 1
[0151.108] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", lpFilePart=0x0) returned 0x34
[0151.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.108] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\h8t-rsy oy1wsabm.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.109] GetFileType (hFile=0x34c) returned 0x1
[0151.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.109] GetFileType (hFile=0x34c) returned 0x1
[0151.109] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1443f
[0151.109] ReadFile (in: hFile=0x34c, lpBuffer=0x21eadf0, nNumberOfBytesToRead=0x1443f, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x21eadf0*, lpNumberOfBytesRead=0x19eeb0*=0x1443f, lpOverlapped=0x0) returned 1
[0151.110] CloseHandle (hObject=0x34c) returned 1
[0151.198] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", lpFilePart=0x0) returned 0x34
[0151.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.198] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\h8t-rsy oy1wsabm.csv"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.203] GetFileType (hFile=0x34c) returned 0x1
[0151.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.203] GetFileType (hFile=0x34c) returned 0x1
[0151.203] WriteFile (in: hFile=0x34c, lpBuffer=0x22749e4*, nNumberOfBytesToWrite=0x14440, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22749e4*, lpNumberOfBytesWritten=0x19eea0*=0x14440, lpOverlapped=0x0) returned 1
[0151.207] CloseHandle (hObject=0x34c) returned 1
[0151.211] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv", lpFilePart=0x0) returned 0x34
[0151.211] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv.coom", lpFilePart=0x0) returned 0x39
[0151.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.211] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\h8t-rsy oy1wsabm.csv"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fdf1610, ftCreationTime.dwHighDateTime=0x1d81eff, ftLastAccessTime.dwLowDateTime=0x7ae89d30, ftLastAccessTime.dwHighDateTime=0x1d8207f, ftLastWriteTime.dwLowDateTime=0x1ef9c704, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x14440)) returned 1
[0151.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.212] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\h8t-rsy oy1wsabm.csv"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\h8t-RSY oy1WSABM.csv.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\h8t-rsy oy1wsabm.csv.coom")) returned 1
[0151.213] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", lpFilePart=0x0) returned 0x29
[0151.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.213] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hgaku.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.213] GetFileType (hFile=0x34c) returned 0x1
[0151.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.214] GetFileType (hFile=0x34c) returned 0x1
[0151.214] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xf2bd
[0151.214] ReadFile (in: hFile=0x34c, lpBuffer=0x22891a8, nNumberOfBytesToRead=0xf2bd, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22891a8*, lpNumberOfBytesRead=0x19eeb0*=0xf2bd, lpOverlapped=0x0) returned 1
[0151.215] CloseHandle (hObject=0x34c) returned 1
[0151.247] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", lpFilePart=0x0) returned 0x29
[0151.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.247] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hgaku.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.249] GetFileType (hFile=0x34c) returned 0x1
[0151.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.250] GetFileType (hFile=0x34c) returned 0x1
[0151.250] WriteFile (in: hFile=0x34c, lpBuffer=0x23037c0*, nNumberOfBytesToWrite=0xf2c0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23037c0*, lpNumberOfBytesWritten=0x19eea0*=0xf2c0, lpOverlapped=0x0) returned 1
[0151.253] CloseHandle (hObject=0x34c) returned 1
[0151.256] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt", lpFilePart=0x0) returned 0x29
[0151.256] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt.coom", lpFilePart=0x0) returned 0x2e
[0151.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.257] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hgaku.odt"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899e2e40, ftCreationTime.dwHighDateTime=0x1d81cf5, ftLastAccessTime.dwLowDateTime=0x5d7c3b20, ftLastAccessTime.dwHighDateTime=0x1d81e96, ftLastWriteTime.dwLowDateTime=0x1f00a999, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xf2c0)) returned 1
[0151.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.257] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hgaku.odt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\hgaKU.odt.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\hgaku.odt.coom")) returned 1
[0151.258] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", lpFilePart=0x0) returned 0x29
[0151.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.258] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\irih.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.258] GetFileType (hFile=0x34c) returned 0x1
[0151.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.258] GetFileType (hFile=0x34c) returned 0x1
[0151.258] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xef62
[0151.258] ReadFile (in: hFile=0x34c, lpBuffer=0x2312d94, nNumberOfBytesToRead=0xef62, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2312d94*, lpNumberOfBytesRead=0x19eeb0*=0xef62, lpOverlapped=0x0) returned 1
[0151.260] CloseHandle (hObject=0x34c) returned 1
[0151.310] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", lpFilePart=0x0) returned 0x29
[0151.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.310] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\irih.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.312] GetFileType (hFile=0x34c) returned 0x1
[0151.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.312] GetFileType (hFile=0x34c) returned 0x1
[0151.312] WriteFile (in: hFile=0x34c, lpBuffer=0x238c9bc*, nNumberOfBytesToWrite=0xef70, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x238c9bc*, lpNumberOfBytesWritten=0x19eea0*=0xef70, lpOverlapped=0x0) returned 1
[0151.315] CloseHandle (hObject=0x34c) returned 1
[0151.319] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx", lpFilePart=0x0) returned 0x29
[0151.319] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx.coom", lpFilePart=0x0) returned 0x2e
[0151.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.319] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\irih.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f402890, ftCreationTime.dwHighDateTime=0x1d7ba24, ftLastAccessTime.dwLowDateTime=0x7255a3c0, ftLastAccessTime.dwHighDateTime=0x1d7ea74, ftLastWriteTime.dwLowDateTime=0x1f0a363c, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xef70)) returned 1
[0151.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.319] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\irih.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iriH.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\irih.docx.coom")) returned 1
[0151.320] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", lpFilePart=0x0) returned 0x35
[0151.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.320] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\isv2cxax0so0nwq3.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.321] GetFileType (hFile=0x34c) returned 0x1
[0151.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.321] GetFileType (hFile=0x34c) returned 0x1
[0151.321] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x454b
[0151.321] ReadFile (in: hFile=0x34c, lpBuffer=0x239bc70, nNumberOfBytesToRead=0x454b, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x239bc70*, lpNumberOfBytesRead=0x19eeb0*=0x454b, lpOverlapped=0x0) returned 1
[0151.321] CloseHandle (hObject=0x34c) returned 1
[0151.404] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", lpFilePart=0x0) returned 0x35
[0151.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.404] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\isv2cxax0so0nwq3.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.406] GetFileType (hFile=0x34c) returned 0x1
[0151.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.406] GetFileType (hFile=0x34c) returned 0x1
[0151.406] WriteFile (in: hFile=0x34c, lpBuffer=0x2202db4*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2202db4*, lpNumberOfBytesWritten=0x19eea0*=0x4550, lpOverlapped=0x0) returned 1
[0151.408] CloseHandle (hObject=0x34c) returned 1
[0151.410] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx", lpFilePart=0x0) returned 0x35
[0151.410] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx.coom", lpFilePart=0x0) returned 0x3a
[0151.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.410] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\isv2cxax0so0nwq3.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee2c490, ftCreationTime.dwHighDateTime=0x1d81b1c, ftLastAccessTime.dwLowDateTime=0x3c989e80, ftLastAccessTime.dwHighDateTime=0x1d81fe0, ftLastWriteTime.dwLowDateTime=0x1f18280a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x4550)) returned 1
[0151.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.411] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\isv2cxax0so0nwq3.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\iSv2CXAx0sO0nwq3.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\isv2cxax0so0nwq3.docx.coom")) returned 1
[0151.412] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", lpFilePart=0x0) returned 0x29
[0151.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.412] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxam.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.412] GetFileType (hFile=0x34c) returned 0x1
[0151.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.412] GetFileType (hFile=0x34c) returned 0x1
[0151.412] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x7e53
[0151.412] ReadFile (in: hFile=0x34c, lpBuffer=0x2207690, nNumberOfBytesToRead=0x7e53, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2207690*, lpNumberOfBytesRead=0x19eeb0*=0x7e53, lpOverlapped=0x0) returned 1
[0151.413] CloseHandle (hObject=0x34c) returned 1
[0151.448] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", lpFilePart=0x0) returned 0x29
[0151.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.448] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxam.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.450] GetFileType (hFile=0x34c) returned 0x1
[0151.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.450] GetFileType (hFile=0x34c) returned 0x1
[0151.451] WriteFile (in: hFile=0x34c, lpBuffer=0x227bd90*, nNumberOfBytesToWrite=0x7e60, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x227bd90*, lpNumberOfBytesWritten=0x19eea0*=0x7e60, lpOverlapped=0x0) returned 1
[0151.452] CloseHandle (hObject=0x34c) returned 1
[0151.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx", lpFilePart=0x0) returned 0x29
[0151.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx.coom", lpFilePart=0x0) returned 0x2e
[0151.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.455] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxam.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf5fa0, ftCreationTime.dwHighDateTime=0x1d824fe, ftLastAccessTime.dwLowDateTime=0x2639b3f0, ftLastAccessTime.dwHighDateTime=0x1d82737, ftLastWriteTime.dwLowDateTime=0x1f1ee629, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7e60)) returned 1
[0151.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.455] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxam.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXAm.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxam.xlsx.coom")) returned 1
[0151.456] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", lpFilePart=0x0) returned 0x37
[0151.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.456] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxf5o1une8gz7vpn-x.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.457] GetFileType (hFile=0x34c) returned 0x1
[0151.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.457] GetFileType (hFile=0x34c) returned 0x1
[0151.457] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xd8e0
[0151.457] ReadFile (in: hFile=0x34c, lpBuffer=0x2283f3c, nNumberOfBytesToRead=0xd8e0, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2283f3c*, lpNumberOfBytesRead=0x19eeb0*=0xd8e0, lpOverlapped=0x0) returned 1
[0151.461] CloseHandle (hObject=0x34c) returned 1
[0151.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", lpFilePart=0x0) returned 0x37
[0151.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.492] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxf5o1une8gz7vpn-x.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.495] GetFileType (hFile=0x34c) returned 0x1
[0151.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.495] GetFileType (hFile=0x34c) returned 0x1
[0151.495] WriteFile (in: hFile=0x34c, lpBuffer=0x22f97e0*, nNumberOfBytesToWrite=0xd8f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22f97e0*, lpNumberOfBytesWritten=0x19eea0*=0xd8f0, lpOverlapped=0x0) returned 1
[0151.501] CloseHandle (hObject=0x34c) returned 1
[0151.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx", lpFilePart=0x0) returned 0x37
[0151.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx.coom", lpFilePart=0x0) returned 0x3c
[0151.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.504] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxf5o1une8gz7vpn-x.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x927389f0, ftCreationTime.dwHighDateTime=0x1d7a9b1, ftLastAccessTime.dwLowDateTime=0x6cd7edd0, ftLastAccessTime.dwHighDateTime=0x1d7eb15, ftLastWriteTime.dwLowDateTime=0x1f26641a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xd8f0)) returned 1
[0151.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.504] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxf5o1une8gz7vpn-x.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\LXf5O1UnE8gZ7VPN-X.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxf5o1une8gz7vpn-x.docx.coom")) returned 1
[0151.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", lpFilePart=0x0) returned 0x32
[0151.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.505] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxh6pbyu5lgk0.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.505] GetFileType (hFile=0x34c) returned 0x1
[0151.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.506] GetFileType (hFile=0x34c) returned 0x1
[0151.506] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x6776
[0151.506] ReadFile (in: hFile=0x34c, lpBuffer=0x2307498, nNumberOfBytesToRead=0x6776, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2307498*, lpNumberOfBytesRead=0x19eeb0*=0x6776, lpOverlapped=0x0) returned 1
[0151.508] CloseHandle (hObject=0x34c) returned 1
[0151.537] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", lpFilePart=0x0) returned 0x32
[0151.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.537] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxh6pbyu5lgk0.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.547] GetFileType (hFile=0x34c) returned 0x1
[0151.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.548] GetFileType (hFile=0x34c) returned 0x1
[0151.548] WriteFile (in: hFile=0x34c, lpBuffer=0x23747dc*, nNumberOfBytesToWrite=0x6780, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23747dc*, lpNumberOfBytesWritten=0x19eea0*=0x6780, lpOverlapped=0x0) returned 1
[0151.550] CloseHandle (hObject=0x34c) returned 1
[0151.553] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx", lpFilePart=0x0) returned 0x32
[0151.553] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx.coom", lpFilePart=0x0) returned 0x37
[0151.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.553] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxh6pbyu5lgk0.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4f2f040, ftCreationTime.dwHighDateTime=0x1d7feac, ftLastAccessTime.dwLowDateTime=0x4744cb10, ftLastAccessTime.dwHighDateTime=0x1d82774, ftLastWriteTime.dwLowDateTime=0x1f2de144, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x6780)) returned 1
[0151.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.553] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxh6pbyu5lgk0.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Lxh6PbYU5lGk0.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lxh6pbyu5lgk0.pptx.coom")) returned 1
[0151.554] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", lpFilePart=0x0) returned 0x30
[0151.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.554] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lyrryp d-2z.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.555] GetFileType (hFile=0x34c) returned 0x1
[0151.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.555] GetFileType (hFile=0x34c) returned 0x1
[0151.555] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x107a9
[0151.555] ReadFile (in: hFile=0x34c, lpBuffer=0x237b2ec, nNumberOfBytesToRead=0x107a9, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x237b2ec*, lpNumberOfBytesRead=0x19eeb0*=0x107a9, lpOverlapped=0x0) returned 1
[0151.557] CloseHandle (hObject=0x34c) returned 1
[0151.597] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", lpFilePart=0x0) returned 0x30
[0151.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.597] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lyrryp d-2z.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.599] GetFileType (hFile=0x34c) returned 0x1
[0151.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.599] GetFileType (hFile=0x34c) returned 0x1
[0151.599] WriteFile (in: hFile=0x34c, lpBuffer=0x2223eb0*, nNumberOfBytesToWrite=0x107b0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2223eb0*, lpNumberOfBytesWritten=0x19eea0*=0x107b0, lpOverlapped=0x0) returned 1
[0151.603] CloseHandle (hObject=0x34c) returned 1
[0151.607] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx", lpFilePart=0x0) returned 0x30
[0151.608] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx.coom", lpFilePart=0x0) returned 0x35
[0151.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.608] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lyrryp d-2z.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eb80d0, ftCreationTime.dwHighDateTime=0x1d82436, ftLastAccessTime.dwLowDateTime=0x25fb4ab0, ftLastAccessTime.dwHighDateTime=0x1d825df, ftLastWriteTime.dwLowDateTime=0x1f36434b, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x107b0)) returned 1
[0151.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.608] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lyrryp d-2z.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\lyrRYp D-2Z.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\lyrryp d-2z.docx.coom")) returned 1
[0151.609] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", lpFilePart=0x0) returned 0x37
[0151.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.609] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\msnffswckp fbcieui5.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.610] GetFileType (hFile=0x34c) returned 0x1
[0151.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.610] GetFileType (hFile=0x34c) returned 0x1
[0151.610] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x13bb0
[0151.610] ReadFile (in: hFile=0x34c, lpBuffer=0x22349f4, nNumberOfBytesToRead=0x13bb0, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22349f4*, lpNumberOfBytesRead=0x19eeb0*=0x13bb0, lpOverlapped=0x0) returned 1
[0151.611] CloseHandle (hObject=0x34c) returned 1
[0151.693] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", lpFilePart=0x0) returned 0x37
[0151.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.694] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\msnffswckp fbcieui5.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.696] GetFileType (hFile=0x34c) returned 0x1
[0151.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.696] GetFileType (hFile=0x34c) returned 0x1
[0151.696] WriteFile (in: hFile=0x34c, lpBuffer=0x22bcc64*, nNumberOfBytesToWrite=0x13bc0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22bcc64*, lpNumberOfBytesWritten=0x19eea0*=0x13bc0, lpOverlapped=0x0) returned 1
[0151.699] CloseHandle (hObject=0x34c) returned 1
[0151.703] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc", lpFilePart=0x0) returned 0x37
[0151.704] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc.coom", lpFilePart=0x0) returned 0x3c
[0151.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.704] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\msnffswckp fbcieui5.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02879f0, ftCreationTime.dwHighDateTime=0x1d826fb, ftLastAccessTime.dwLowDateTime=0xc3865040, ftLastAccessTime.dwHighDateTime=0x1d827ab, ftLastWriteTime.dwLowDateTime=0x1f44df65, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13bc0)) returned 1
[0151.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.705] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\msnffswckp fbcieui5.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\MSNffSwckP FbcIEuI5.doc.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\msnffswckp fbcieui5.doc.coom")) returned 1
[0151.706] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", lpFilePart=0x0) returned 0x2c
[0151.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.706] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n7hkhiqs.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.706] GetFileType (hFile=0x34c) returned 0x1
[0151.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.707] GetFileType (hFile=0x34c) returned 0x1
[0151.707] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x3e19
[0151.707] ReadFile (in: hFile=0x34c, lpBuffer=0x22d0bd4, nNumberOfBytesToRead=0x3e19, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22d0bd4*, lpNumberOfBytesRead=0x19eeb0*=0x3e19, lpOverlapped=0x0) returned 1
[0151.707] CloseHandle (hObject=0x34c) returned 1
[0151.734] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", lpFilePart=0x0) returned 0x2c
[0151.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.735] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n7hkhiqs.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.737] GetFileType (hFile=0x34c) returned 0x1
[0151.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.737] GetFileType (hFile=0x34c) returned 0x1
[0151.737] WriteFile (in: hFile=0x34c, lpBuffer=0x2331038*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2331038*, lpNumberOfBytesWritten=0x19eea0*=0x3e20, lpOverlapped=0x0) returned 1
[0151.739] CloseHandle (hObject=0x34c) returned 1
[0151.741] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf", lpFilePart=0x0) returned 0x2c
[0151.741] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf.coom", lpFilePart=0x0) returned 0x31
[0151.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n7hkhiqs.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe55e5d0, ftCreationTime.dwHighDateTime=0x1d81cad, ftLastAccessTime.dwLowDateTime=0xb079e420, ftLastAccessTime.dwHighDateTime=0x1d824d2, ftLastWriteTime.dwLowDateTime=0x1f4a9026, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x3e20)) returned 1
[0151.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.745] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n7hkhiqs.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\n7hKHIqS.rtf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\n7hkhiqs.rtf.coom")) returned 1
[0151.746] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", lpFilePart=0x0) returned 0x34
[0151.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.746] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ocgatxc-6ez0hk_y.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.746] GetFileType (hFile=0x34c) returned 0x1
[0151.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.746] GetFileType (hFile=0x34c) returned 0x1
[0151.746] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xf85f
[0151.746] ReadFile (in: hFile=0x34c, lpBuffer=0x23351bc, nNumberOfBytesToRead=0xf85f, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23351bc*, lpNumberOfBytesRead=0x19eeb0*=0xf85f, lpOverlapped=0x0) returned 1
[0151.747] CloseHandle (hObject=0x34c) returned 1
[0151.795] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", lpFilePart=0x0) returned 0x34
[0151.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.796] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ocgatxc-6ez0hk_y.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.798] GetFileType (hFile=0x34c) returned 0x1
[0151.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.798] GetFileType (hFile=0x34c) returned 0x1
[0151.798] WriteFile (in: hFile=0x34c, lpBuffer=0x21e9008*, nNumberOfBytesToWrite=0xf860, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x21e9008*, lpNumberOfBytesWritten=0x19eea0*=0xf860, lpOverlapped=0x0) returned 1
[0151.801] CloseHandle (hObject=0x34c) returned 1
[0151.805] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls", lpFilePart=0x0) returned 0x34
[0151.805] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls.coom", lpFilePart=0x0) returned 0x39
[0151.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.805] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ocgatxc-6ez0hk_y.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc50c0, ftCreationTime.dwHighDateTime=0x1d819fd, ftLastAccessTime.dwLowDateTime=0x5f903f90, ftLastAccessTime.dwHighDateTime=0x1d81b8c, ftLastWriteTime.dwLowDateTime=0x1f545aaf, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xf860)) returned 1
[0151.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.805] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ocgatxc-6ez0hk_y.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ocgatxC-6Ez0Hk_y.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\ocgatxc-6ez0hk_y.xls.coom")) returned 1
[0151.807] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", lpFilePart=0x0) returned 0x31
[0151.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.807] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\owf5pa qzmhbd.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.807] GetFileType (hFile=0x34c) returned 0x1
[0151.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.807] GetFileType (hFile=0x34c) returned 0x1
[0151.807] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xa3ee
[0151.808] ReadFile (in: hFile=0x34c, lpBuffer=0x21f8c0c, nNumberOfBytesToRead=0xa3ee, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x21f8c0c*, lpNumberOfBytesRead=0x19eeb0*=0xa3ee, lpOverlapped=0x0) returned 1
[0151.808] CloseHandle (hObject=0x34c) returned 1
[0151.876] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", lpFilePart=0x0) returned 0x31
[0151.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.876] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\owf5pa qzmhbd.rtf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.878] GetFileType (hFile=0x34c) returned 0x1
[0151.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.878] GetFileType (hFile=0x34c) returned 0x1
[0151.878] WriteFile (in: hFile=0x34c, lpBuffer=0x2278edc*, nNumberOfBytesToWrite=0xa3f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2278edc*, lpNumberOfBytesWritten=0x19eea0*=0xa3f0, lpOverlapped=0x0) returned 1
[0151.880] CloseHandle (hObject=0x34c) returned 1
[0151.883] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf", lpFilePart=0x0) returned 0x31
[0151.883] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf.coom", lpFilePart=0x0) returned 0x36
[0151.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0151.883] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\owf5pa qzmhbd.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f827a60, ftCreationTime.dwHighDateTime=0x1d81dca, ftLastAccessTime.dwLowDateTime=0x59dd3ca0, ftLastAccessTime.dwHighDateTime=0x1d823df, ftLastWriteTime.dwLowDateTime=0x1f603d67, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xa3f0)) returned 1
[0151.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0151.883] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\owf5pa qzmhbd.rtf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\owF5pa QZMhBD.rtf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\owf5pa qzmhbd.rtf.coom")) returned 1
[0151.886] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", lpFilePart=0x0) returned 0x36
[0151.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0151.887] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\p9ul--trl_6unnwprc.odt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.887] GetFileType (hFile=0x34c) returned 0x1
[0151.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0151.887] GetFileType (hFile=0x34c) returned 0x1
[0151.887] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x4953
[0151.887] ReadFile (in: hFile=0x34c, lpBuffer=0x2283668, nNumberOfBytesToRead=0x4953, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2283668*, lpNumberOfBytesRead=0x19eeb0*=0x4953, lpOverlapped=0x0) returned 1
[0151.888] CloseHandle (hObject=0x34c) returned 1
[0151.911] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", lpFilePart=0x0) returned 0x36
[0151.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0151.912] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\p9ul--trl_6unnwprc.odt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0151.914] GetFileType (hFile=0x34c) returned 0x1
[0151.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0151.914] GetFileType (hFile=0x34c) returned 0x1
[0151.914] WriteFile (in: hFile=0x34c, lpBuffer=0x22e730c*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22e730c*, lpNumberOfBytesWritten=0x19eea0*=0x4960, lpOverlapped=0x0) returned 1
[0151.916] CloseHandle (hObject=0x34c) returned 1
[0152.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt", lpFilePart=0x0) returned 0x36
[0152.145] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt.coom", lpFilePart=0x0) returned 0x3b
[0152.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.145] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\p9ul--trl_6unnwprc.odt"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc572d180, ftCreationTime.dwHighDateTime=0x1d8296d, ftLastAccessTime.dwLowDateTime=0x9b0dd40, ftLastAccessTime.dwHighDateTime=0x1d829f2, ftLastWriteTime.dwLowDateTime=0x1f882768, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x4960)) returned 1
[0152.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.145] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\p9ul--trl_6unnwprc.odt"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\p9uL--tRL_6UnNWprC.odt.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\p9ul--trl_6unnwprc.odt.coom")) returned 1
[0152.146] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", lpFilePart=0x0) returned 0x38
[0152.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.146] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\psjlpn8drurz1-xy6fw_.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.147] GetFileType (hFile=0x34c) returned 0x1
[0152.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.147] GetFileType (hFile=0x34c) returned 0x1
[0152.147] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x12344
[0152.147] ReadFile (in: hFile=0x34c, lpBuffer=0x22ec044, nNumberOfBytesToRead=0x12344, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22ec044*, lpNumberOfBytesRead=0x19eeb0*=0x12344, lpOverlapped=0x0) returned 1
[0152.148] CloseHandle (hObject=0x34c) returned 1
[0152.179] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", lpFilePart=0x0) returned 0x38
[0152.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.179] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\psjlpn8drurz1-xy6fw_.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.183] GetFileType (hFile=0x34c) returned 0x1
[0152.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.184] GetFileType (hFile=0x34c) returned 0x1
[0152.184] WriteFile (in: hFile=0x34c, lpBuffer=0x236f808*, nNumberOfBytesToWrite=0x12350, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x236f808*, lpNumberOfBytesWritten=0x19eea0*=0x12350, lpOverlapped=0x0) returned 1
[0152.187] CloseHandle (hObject=0x34c) returned 1
[0152.191] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf", lpFilePart=0x0) returned 0x38
[0152.192] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf.coom", lpFilePart=0x0) returned 0x3d
[0152.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.192] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\psjlpn8drurz1-xy6fw_.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dc60980, ftCreationTime.dwHighDateTime=0x1d829a0, ftLastAccessTime.dwLowDateTime=0xa1794260, ftLastAccessTime.dwHighDateTime=0x1d829f3, ftLastWriteTime.dwLowDateTime=0x1f8f599a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x12350)) returned 1
[0152.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.192] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\psjlpn8drurz1-xy6fw_.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\pSJLpn8DrUrz1-Xy6Fw_.pdf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\psjlpn8drurz1-xy6fw_.pdf.coom")) returned 1
[0152.193] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", lpFilePart=0x0) returned 0x32
[0152.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.193] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\q9j2c2vhqgqt8y.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.194] GetFileType (hFile=0x34c) returned 0x1
[0152.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.194] GetFileType (hFile=0x34c) returned 0x1
[0152.194] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x10b71
[0152.194] ReadFile (in: hFile=0x34c, lpBuffer=0x2381f2c, nNumberOfBytesToRead=0x10b71, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2381f2c*, lpNumberOfBytesRead=0x19eeb0*=0x10b71, lpOverlapped=0x0) returned 1
[0152.195] CloseHandle (hObject=0x34c) returned 1
[0152.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", lpFilePart=0x0) returned 0x32
[0152.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.227] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\q9j2c2vhqgqt8y.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.229] GetFileType (hFile=0x34c) returned 0x1
[0152.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.229] GetFileType (hFile=0x34c) returned 0x1
[0152.229] WriteFile (in: hFile=0x34c, lpBuffer=0x2400f84*, nNumberOfBytesToWrite=0x10b80, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2400f84*, lpNumberOfBytesWritten=0x19eea0*=0x10b80, lpOverlapped=0x0) returned 1
[0152.232] CloseHandle (hObject=0x34c) returned 1
[0152.235] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls", lpFilePart=0x0) returned 0x32
[0152.235] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls.coom", lpFilePart=0x0) returned 0x37
[0152.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.235] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\q9j2c2vhqgqt8y.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6810580, ftCreationTime.dwHighDateTime=0x1d819e3, ftLastAccessTime.dwLowDateTime=0x3c8de40, ftLastAccessTime.dwHighDateTime=0x1d81ed6, ftLastWriteTime.dwLowDateTime=0x1f95f720, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x10b80)) returned 1
[0152.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.235] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\q9j2c2vhqgqt8y.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\q9j2C2vhqGqT8Y.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\q9j2c2vhqgqt8y.xls.coom")) returned 1
[0152.239] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", lpFilePart=0x0) returned 0x39
[0152.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.239] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qi06dg7isl hmonv94db.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.240] GetFileType (hFile=0x34c) returned 0x1
[0152.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.240] GetFileType (hFile=0x34c) returned 0x1
[0152.240] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1160
[0152.240] ReadFile (in: hFile=0x34c, lpBuffer=0x2411eb4, nNumberOfBytesToRead=0x1160, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2411eb4*, lpNumberOfBytesRead=0x19eeb0*=0x1160, lpOverlapped=0x0) returned 1
[0152.240] CloseHandle (hObject=0x34c) returned 1
[0152.319] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", lpFilePart=0x0) returned 0x39
[0152.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.320] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qi06dg7isl hmonv94db.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.321] GetFileType (hFile=0x34c) returned 0x1
[0152.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.321] GetFileType (hFile=0x34c) returned 0x1
[0152.321] WriteFile (in: hFile=0x34c, lpBuffer=0x24643a4*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x24643a4*, lpNumberOfBytesWritten=0x19eea0*=0x1170, lpOverlapped=0x0) returned 1
[0152.322] CloseHandle (hObject=0x34c) returned 1
[0152.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx", lpFilePart=0x0) returned 0x39
[0152.323] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx.coom", lpFilePart=0x0) returned 0x3e
[0152.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qi06dg7isl hmonv94db.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8100020, ftCreationTime.dwHighDateTime=0x1d81323, ftLastAccessTime.dwLowDateTime=0x5835a220, ftLastAccessTime.dwHighDateTime=0x1d821a5, ftLastWriteTime.dwLowDateTime=0x1fa380f7, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x1170)) returned 1
[0152.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.324] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qi06dg7isl hmonv94db.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Qi06Dg7iSL hMONv94Db.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qi06dg7isl hmonv94db.xlsx.coom")) returned 1
[0152.325] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", lpFilePart=0x0) returned 0x38
[0152.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.325] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qqwlqdbqrfvam vqx4dg.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.325] GetFileType (hFile=0x34c) returned 0x1
[0152.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.325] GetFileType (hFile=0x34c) returned 0x1
[0152.325] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x11ef1
[0152.325] ReadFile (in: hFile=0x34c, lpBuffer=0x2465908, nNumberOfBytesToRead=0x11ef1, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2465908*, lpNumberOfBytesRead=0x19eeb0*=0x11ef1, lpOverlapped=0x0) returned 1
[0152.326] CloseHandle (hObject=0x34c) returned 1
[0152.396] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", lpFilePart=0x0) returned 0x38
[0152.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.396] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qqwlqdbqrfvam vqx4dg.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.398] GetFileType (hFile=0x34c) returned 0x1
[0152.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.398] GetFileType (hFile=0x34c) returned 0x1
[0152.398] WriteFile (in: hFile=0x34c, lpBuffer=0x2255350*, nNumberOfBytesToWrite=0x11f00, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2255350*, lpNumberOfBytesWritten=0x19eea0*=0x11f00, lpOverlapped=0x0) returned 1
[0152.400] CloseHandle (hObject=0x34c) returned 1
[0152.403] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf", lpFilePart=0x0) returned 0x38
[0152.403] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf.coom", lpFilePart=0x0) returned 0x3d
[0152.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qqwlqdbqrfvam vqx4dg.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31a5460, ftCreationTime.dwHighDateTime=0x1d8274a, ftLastAccessTime.dwLowDateTime=0x744511a0, ftLastAccessTime.dwHighDateTime=0x1d82883, ftLastWriteTime.dwLowDateTime=0x1fafa201, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x11f00)) returned 1
[0152.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.403] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qqwlqdbqrfvam vqx4dg.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\QqWlqDBqRFVAm vqX4DG.pdf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\qqwlqdbqrfvam vqx4dg.pdf.coom")) returned 1
[0152.404] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", lpFilePart=0x0) returned 0x36
[0152.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.404] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\tdg1tr6sd8r 70ytf.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.404] GetFileType (hFile=0x34c) returned 0x1
[0152.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.404] GetFileType (hFile=0x34c) returned 0x1
[0152.404] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xcfc1
[0152.404] ReadFile (in: hFile=0x34c, lpBuffer=0x226764c, nNumberOfBytesToRead=0xcfc1, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x226764c*, lpNumberOfBytesRead=0x19eeb0*=0xcfc1, lpOverlapped=0x0) returned 1
[0152.405] CloseHandle (hObject=0x34c) returned 1
[0152.429] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", lpFilePart=0x0) returned 0x36
[0152.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.429] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\tdg1tr6sd8r 70ytf.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.431] GetFileType (hFile=0x34c) returned 0x1
[0152.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.431] GetFileType (hFile=0x34c) returned 0x1
[0152.431] WriteFile (in: hFile=0x34c, lpBuffer=0x22db4f0*, nNumberOfBytesToWrite=0xcfd0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22db4f0*, lpNumberOfBytesWritten=0x19eea0*=0xcfd0, lpOverlapped=0x0) returned 1
[0152.434] CloseHandle (hObject=0x34c) returned 1
[0152.436] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx", lpFilePart=0x0) returned 0x36
[0152.437] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx.coom", lpFilePart=0x0) returned 0x3b
[0152.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.437] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\tdg1tr6sd8r 70ytf.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25d63a50, ftCreationTime.dwHighDateTime=0x1d81e3b, ftLastAccessTime.dwLowDateTime=0x72d93c00, ftLastAccessTime.dwHighDateTime=0x1d82988, ftLastWriteTime.dwLowDateTime=0x1fb4bc09, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xcfd0)) returned 1
[0152.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.437] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\tdg1tr6sd8r 70ytf.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\TDG1tR6SD8R 70ytf.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\tdg1tr6sd8r 70ytf.docx.coom")) returned 1
[0152.438] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", lpFilePart=0x0) returned 0x31
[0152.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.438] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uhtnuhwyzpoex.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.438] GetFileType (hFile=0x34c) returned 0x1
[0152.438] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.438] GetFileType (hFile=0x34c) returned 0x1
[0152.438] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x57f2
[0152.439] ReadFile (in: hFile=0x34c, lpBuffer=0x22e8878, nNumberOfBytesToRead=0x57f2, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22e8878*, lpNumberOfBytesRead=0x19eeb0*=0x57f2, lpOverlapped=0x0) returned 1
[0152.440] CloseHandle (hObject=0x34c) returned 1
[0152.462] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", lpFilePart=0x0) returned 0x31
[0152.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.463] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uhtnuhwyzpoex.pdf"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.464] GetFileType (hFile=0x34c) returned 0x1
[0152.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.464] GetFileType (hFile=0x34c) returned 0x1
[0152.464] WriteFile (in: hFile=0x34c, lpBuffer=0x2350e3c*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2350e3c*, lpNumberOfBytesWritten=0x19eea0*=0x5800, lpOverlapped=0x0) returned 1
[0152.466] CloseHandle (hObject=0x34c) returned 1
[0152.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf", lpFilePart=0x0) returned 0x31
[0152.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf.coom", lpFilePart=0x0) returned 0x36
[0152.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uhtnuhwyzpoex.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53efdbf0, ftCreationTime.dwHighDateTime=0x1d821c2, ftLastAccessTime.dwLowDateTime=0x74932200, ftLastAccessTime.dwHighDateTime=0x1d8270c, ftLastWriteTime.dwLowDateTime=0x1fb97906, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x5800)) returned 1
[0152.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.468] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uhtnuhwyzpoex.pdf"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uhTnuhWyZPoex.pdf.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uhtnuhwyzpoex.pdf.coom")) returned 1
[0152.469] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", lpFilePart=0x0) returned 0x30
[0152.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.469] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uiwqdmyw8ql.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.469] GetFileType (hFile=0x34c) returned 0x1
[0152.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.469] GetFileType (hFile=0x34c) returned 0x1
[0152.469] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x5c40
[0152.469] ReadFile (in: hFile=0x34c, lpBuffer=0x23569c0, nNumberOfBytesToRead=0x5c40, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23569c0*, lpNumberOfBytesRead=0x19eeb0*=0x5c40, lpOverlapped=0x0) returned 1
[0152.471] CloseHandle (hObject=0x34c) returned 1
[0152.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", lpFilePart=0x0) returned 0x30
[0152.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.504] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uiwqdmyw8ql.docx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.506] GetFileType (hFile=0x34c) returned 0x1
[0152.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.506] GetFileType (hFile=0x34c) returned 0x1
[0152.506] WriteFile (in: hFile=0x34c, lpBuffer=0x23c0510*, nNumberOfBytesToWrite=0x5c50, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23c0510*, lpNumberOfBytesWritten=0x19eea0*=0x5c50, lpOverlapped=0x0) returned 1
[0152.507] CloseHandle (hObject=0x34c) returned 1
[0152.511] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx", lpFilePart=0x0) returned 0x30
[0152.511] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx.coom", lpFilePart=0x0) returned 0x35
[0152.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.511] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uiwqdmyw8ql.docx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6982eec0, ftCreationTime.dwHighDateTime=0x1d7bba7, ftLastAccessTime.dwLowDateTime=0xbbf9d860, ftLastAccessTime.dwHighDateTime=0x1d7d567, ftLastWriteTime.dwLowDateTime=0x1fc00cd6, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x5c50)) returned 1
[0152.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.511] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uiwqdmyw8ql.docx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\uIwqDmYW8Ql.docx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\uiwqdmyw8ql.docx.coom")) returned 1
[0152.512] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", lpFilePart=0x0) returned 0x29
[0152.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.512] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vcyeh.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.512] GetFileType (hFile=0x34c) returned 0x1
[0152.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.512] GetFileType (hFile=0x34c) returned 0x1
[0152.512] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x17d54
[0152.513] ReadFile (in: hFile=0x34c, lpBuffer=0x3284a50, nNumberOfBytesToRead=0x17d54, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3284a50*, lpNumberOfBytesRead=0x19eeb0*=0x17d54, lpOverlapped=0x0) returned 1
[0152.515] CloseHandle (hObject=0x34c) returned 1
[0152.586] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", lpFilePart=0x0) returned 0x29
[0152.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.587] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vcyeh.doc"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.589] GetFileType (hFile=0x34c) returned 0x1
[0152.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.589] GetFileType (hFile=0x34c) returned 0x1
[0152.589] WriteFile (in: hFile=0x34c, lpBuffer=0x32fbd60*, nNumberOfBytesToWrite=0x17d60, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x32fbd60*, lpNumberOfBytesWritten=0x19eea0*=0x17d60, lpOverlapped=0x0) returned 1
[0152.592] CloseHandle (hObject=0x34c) returned 1
[0152.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc", lpFilePart=0x0) returned 0x29
[0152.596] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc.coom", lpFilePart=0x0) returned 0x2e
[0152.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.596] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vcyeh.doc"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdba143d0, ftCreationTime.dwHighDateTime=0x1d81ec1, ftLastAccessTime.dwLowDateTime=0x1494afb0, ftLastAccessTime.dwHighDateTime=0x1d8202f, ftLastWriteTime.dwLowDateTime=0x1fcd0b8a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17d60)) returned 1
[0152.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.596] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vcyeh.doc"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\vcYEH.doc.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\vcyeh.doc.coom")) returned 1
[0152.597] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", lpFilePart=0x0) returned 0x33
[0152.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.597] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wlztxestugu f3.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.597] GetFileType (hFile=0x34c) returned 0x1
[0152.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.597] GetFileType (hFile=0x34c) returned 0x1
[0152.597] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x79d1
[0152.598] ReadFile (in: hFile=0x34c, lpBuffer=0x22139b8, nNumberOfBytesToRead=0x79d1, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22139b8*, lpNumberOfBytesRead=0x19eeb0*=0x79d1, lpOverlapped=0x0) returned 1
[0152.598] CloseHandle (hObject=0x34c) returned 1
[0152.619] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", lpFilePart=0x0) returned 0x33
[0152.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.619] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wlztxestugu f3.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.623] GetFileType (hFile=0x34c) returned 0x1
[0152.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.623] GetFileType (hFile=0x34c) returned 0x1
[0152.623] WriteFile (in: hFile=0x34c, lpBuffer=0x2286a38*, nNumberOfBytesToWrite=0x79e0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2286a38*, lpNumberOfBytesWritten=0x19eea0*=0x79e0, lpOverlapped=0x0) returned 1
[0152.625] CloseHandle (hObject=0x34c) returned 1
[0152.626] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx", lpFilePart=0x0) returned 0x33
[0152.626] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx.coom", lpFilePart=0x0) returned 0x38
[0152.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.627] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wlztxestugu f3.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c075f0, ftCreationTime.dwHighDateTime=0x1d7dd97, ftLastAccessTime.dwLowDateTime=0x3bac3590, ftLastAccessTime.dwHighDateTime=0x1d81aa4, ftLastWriteTime.dwLowDateTime=0x1fd1bffd, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x79e0)) returned 1
[0152.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.627] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wlztxestugu f3.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wlZTxESTUgU f3.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wlztxestugu f3.xlsx.coom")) returned 1
[0152.627] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", lpFilePart=0x0) returned 0x28
[0152.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.628] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wu7s.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.628] GetFileType (hFile=0x34c) returned 0x1
[0152.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.628] GetFileType (hFile=0x34c) returned 0x1
[0152.628] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x16363
[0152.629] ReadFile (in: hFile=0x34c, lpBuffer=0x3313ae0, nNumberOfBytesToRead=0x16363, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3313ae0*, lpNumberOfBytesRead=0x19eeb0*=0x16363, lpOverlapped=0x0) returned 1
[0152.631] CloseHandle (hObject=0x34c) returned 1
[0152.700] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", lpFilePart=0x0) returned 0x28
[0152.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.700] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wu7s.xls"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.702] GetFileType (hFile=0x34c) returned 0x1
[0152.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.702] GetFileType (hFile=0x34c) returned 0x1
[0152.702] WriteFile (in: hFile=0x34c, lpBuffer=0x3382c40*, nNumberOfBytesToWrite=0x16370, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3382c40*, lpNumberOfBytesWritten=0x19eea0*=0x16370, lpOverlapped=0x0) returned 1
[0152.705] CloseHandle (hObject=0x34c) returned 1
[0152.709] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls", lpFilePart=0x0) returned 0x28
[0152.709] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls.coom", lpFilePart=0x0) returned 0x2d
[0152.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.709] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wu7s.xls"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea61beb0, ftCreationTime.dwHighDateTime=0x1d81aa5, ftLastAccessTime.dwLowDateTime=0x48b00210, ftLastAccessTime.dwHighDateTime=0x1d823ca, ftLastWriteTime.dwLowDateTime=0x1fde5204, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x16370)) returned 1
[0152.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.709] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wu7s.xls"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\WU7S.xls.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wu7s.xls.coom")) returned 1
[0152.714] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", lpFilePart=0x0) returned 0x32
[0152.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.714] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wve9flhzacbjm.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.714] GetFileType (hFile=0x34c) returned 0x1
[0152.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.714] GetFileType (hFile=0x34c) returned 0x1
[0152.714] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x7e86
[0152.714] ReadFile (in: hFile=0x34c, lpBuffer=0x22db898, nNumberOfBytesToRead=0x7e86, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22db898*, lpNumberOfBytesRead=0x19eeb0*=0x7e86, lpOverlapped=0x0) returned 1
[0152.715] CloseHandle (hObject=0x34c) returned 1
[0152.738] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", lpFilePart=0x0) returned 0x32
[0152.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.738] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wve9flhzacbjm.pptx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.739] GetFileType (hFile=0x34c) returned 0x1
[0152.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.741] GetFileType (hFile=0x34c) returned 0x1
[0152.741] WriteFile (in: hFile=0x34c, lpBuffer=0x234ff2c*, nNumberOfBytesToWrite=0x7e90, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x234ff2c*, lpNumberOfBytesWritten=0x19eea0*=0x7e90, lpOverlapped=0x0) returned 1
[0152.743] CloseHandle (hObject=0x34c) returned 1
[0152.745] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx", lpFilePart=0x0) returned 0x32
[0152.745] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx.coom", lpFilePart=0x0) returned 0x37
[0152.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.745] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wve9flhzacbjm.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x199007f0, ftCreationTime.dwHighDateTime=0x1d8218b, ftLastAccessTime.dwLowDateTime=0x3e7a2700, ftLastAccessTime.dwHighDateTime=0x1d826f7, ftLastWriteTime.dwLowDateTime=0x1fe3c833, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x7e90)) returned 1
[0152.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.745] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wve9flhzacbjm.pptx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\wVE9flHzacBjM.pptx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\wve9flhzacbjm.pptx.coom")) returned 1
[0152.746] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", lpFilePart=0x0) returned 0x37
[0152.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.746] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\y8tckri kxxqhv9oqq.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.746] GetFileType (hFile=0x34c) returned 0x1
[0152.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.746] GetFileType (hFile=0x34c) returned 0x1
[0152.747] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x5a5a
[0152.747] ReadFile (in: hFile=0x34c, lpBuffer=0x2358164, nNumberOfBytesToRead=0x5a5a, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2358164*, lpNumberOfBytesRead=0x19eeb0*=0x5a5a, lpOverlapped=0x0) returned 1
[0152.747] CloseHandle (hObject=0x34c) returned 1
[0152.805] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", lpFilePart=0x0) returned 0x37
[0152.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.805] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\y8tckri kxxqhv9oqq.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.807] GetFileType (hFile=0x34c) returned 0x1
[0152.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.807] GetFileType (hFile=0x34c) returned 0x1
[0152.807] WriteFile (in: hFile=0x34c, lpBuffer=0x23c1308*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23c1308*, lpNumberOfBytesWritten=0x19eea0*=0x5a60, lpOverlapped=0x0) returned 1
[0152.810] CloseHandle (hObject=0x34c) returned 1
[0152.812] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx", lpFilePart=0x0) returned 0x37
[0152.812] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx.coom", lpFilePart=0x0) returned 0x3c
[0152.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.812] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\y8tckri kxxqhv9oqq.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148e4700, ftCreationTime.dwHighDateTime=0x1d7e3ea, ftLastAccessTime.dwLowDateTime=0xbefc52e0, ftLastAccessTime.dwHighDateTime=0x1d819d7, ftLastWriteTime.dwLowDateTime=0x1fee0221, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x5a60)) returned 1
[0152.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.812] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\y8tckri kxxqhv9oqq.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\y8TckRi KxxqHv9oqq.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\y8tckri kxxqhv9oqq.xlsx.coom")) returned 1
[0152.813] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", lpFilePart=0x0) returned 0x2e
[0152.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.813] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zjrfdpfcl.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.813] GetFileType (hFile=0x34c) returned 0x1
[0152.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.813] GetFileType (hFile=0x34c) returned 0x1
[0152.813] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x17858
[0152.814] ReadFile (in: hFile=0x34c, lpBuffer=0x3398fd0, nNumberOfBytesToRead=0x17858, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3398fd0*, lpNumberOfBytesRead=0x19eeb0*=0x17858, lpOverlapped=0x0) returned 1
[0152.816] CloseHandle (hObject=0x34c) returned 1
[0152.896] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", lpFilePart=0x0) returned 0x2e
[0152.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.896] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zjrfdpfcl.xlsx"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.898] GetFileType (hFile=0x34c) returned 0x1
[0152.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.898] GetFileType (hFile=0x34c) returned 0x1
[0152.898] WriteFile (in: hFile=0x34c, lpBuffer=0x340e9e8*, nNumberOfBytesToWrite=0x17860, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x340e9e8*, lpNumberOfBytesWritten=0x19eea0*=0x17860, lpOverlapped=0x0) returned 1
[0152.901] CloseHandle (hObject=0x34c) returned 1
[0152.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx", lpFilePart=0x0) returned 0x2e
[0152.906] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx.coom", lpFilePart=0x0) returned 0x33
[0152.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.906] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zjrfdpfcl.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cc5da00, ftCreationTime.dwHighDateTime=0x1d7d439, ftLastAccessTime.dwLowDateTime=0xc0d81010, ftLastAccessTime.dwHighDateTime=0x1d7f1bc, ftLastWriteTime.dwLowDateTime=0x1ffc5007, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17860)) returned 1
[0152.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.906] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zjrfdpfcl.xlsx"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZJRfdPfcL.xlsx.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zjrfdpfcl.xlsx.coom")) returned 1
[0152.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", lpFilePart=0x0) returned 0x2a
[0152.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0152.907] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zwafqo.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.907] GetFileType (hFile=0x34c) returned 0x1
[0152.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0152.907] GetFileType (hFile=0x34c) returned 0x1
[0152.907] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x16987
[0152.908] ReadFile (in: hFile=0x34c, lpBuffer=0x3426268, nNumberOfBytesToRead=0x16987, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3426268*, lpNumberOfBytesRead=0x19eeb0*=0x16987, lpOverlapped=0x0) returned 1
[0152.910] CloseHandle (hObject=0x34c) returned 1
[0152.943] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", lpFilePart=0x0) returned 0x2a
[0152.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0152.943] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zwafqo.pps"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.945] GetFileType (hFile=0x34c) returned 0x1
[0152.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0152.945] GetFileType (hFile=0x34c) returned 0x1
[0152.945] WriteFile (in: hFile=0x34c, lpBuffer=0x3497270*, nNumberOfBytesToWrite=0x16990, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3497270*, lpNumberOfBytesWritten=0x19eea0*=0x16990, lpOverlapped=0x0) returned 1
[0152.948] CloseHandle (hObject=0x34c) returned 1
[0152.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps", lpFilePart=0x0) returned 0x2a
[0152.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps.coom", lpFilePart=0x0) returned 0x2f
[0152.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0152.953] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zwafqo.pps"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd083fcf0, ftCreationTime.dwHighDateTime=0x1d823c5, ftLastAccessTime.dwLowDateTime=0x7d735750, ftLastAccessTime.dwHighDateTime=0x1d8240f, ftLastWriteTime.dwLowDateTime=0x20038ac9, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x16990)) returned 1
[0152.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0152.953] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zwafqo.pps"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\ZWAFqo.pps.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\zwafqo.pps.coom")) returned 1
[0152.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0152.954] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music", lpFilePart=0x0) returned 0x28
[0152.955] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\", lpFilePart=0x0) returned 0x29
[0152.955] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Music\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0152.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee8c) returned 1
[0152.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0152.981] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures", lpFilePart=0x0) returned 0x2b
[0152.981] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x2c
[0152.981] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Pictures\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0152.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee8c) returned 1
[0152.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0152.984] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos", lpFilePart=0x0) returned 0x29
[0152.984] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x2a
[0152.984] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\My Videos\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff
[0152.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee8c) returned 1
[0152.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0152.986] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d
[0152.986] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x2e
[0152.986] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690920
[0152.987] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0152.988] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878917cb, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 1
[0152.988] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0152.988] FindClose (in: hFindFile=0x690920 | out: hFindFile=0x690920) returned 1
[0152.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1
[0152.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1
[0152.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0152.988] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x2d
[0152.988] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x2e
[0152.988] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690660
[0152.989] FindNextFileW (in: hFindFile=0x690660, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63954f0d, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x65ef9a5c, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878c65f2, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0152.989] FindNextFileW (in: hFindFile=0x690660, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878917cb, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 1
[0152.989] FindNextFileW (in: hFindFile=0x690660, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x878917cb, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="achoo@gdllo.de.pst", cAlternateFileName="ACHOO@~1.PST")) returned 0
[0152.989] FindClose (in: hFindFile=0x690660 | out: hFindFile=0x690660) returned 1
[0152.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1
[0152.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1
[0152.990] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", nBufferLength=0x105, lpBuffer=0x19e8c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", lpFilePart=0x0) returned 0x40
[0152.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edbc) returned 1
[0152.990] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0152.990] GetFileType (hFile=0x34c) returned 0x1
[0152.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edb8) returned 1
[0152.990] GetFileType (hFile=0x34c) returned 0x1
[0152.990] GetFileSize (in: hFile=0x34c, lpFileSizeHigh=0x19eec4 | out: lpFileSizeHigh=0x19eec4*=0x0) returned 0x42400
[0152.991] ReadFile (in: hFile=0x34c, lpBuffer=0x34adc20, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x19ee70, lpOverlapped=0x0 | out: lpBuffer=0x34adc20*, lpNumberOfBytesRead=0x19ee70*=0x42400, lpOverlapped=0x0) returned 1
[0153.005] CloseHandle (hObject=0x34c) returned 1
[0153.083] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", nBufferLength=0x105, lpBuffer=0x19e8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", lpFilePart=0x0) returned 0x40
[0153.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eda4) returned 1
[0153.083] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x34c
[0153.088] GetFileType (hFile=0x34c) returned 0x1
[0153.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eda0) returned 1
[0153.088] GetFileType (hFile=0x34c) returned 0x1
[0153.088] WriteFile (in: hFile=0x34c, lpBuffer=0x32eaeb0*, nNumberOfBytesToWrite=0x42410, lpNumberOfBytesWritten=0x19ee60, lpOverlapped=0x0 | out: lpBuffer=0x32eaeb0*, lpNumberOfBytesWritten=0x19ee60*=0x42410, lpOverlapped=0x0) returned 1
[0153.095] CloseHandle (hObject=0x34c) returned 1
[0153.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst", lpFilePart=0x0) returned 0x40
[0153.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst.coom", nBufferLength=0x105, lpBuffer=0x19e9e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst.coom", lpFilePart=0x0) returned 0x45
[0153.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee48) returned 1
[0153.104] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), fInfoLevelId=0x0, lpFileInformation=0x19eec4 | out: lpFileInformation=0x19eec4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6397affd, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6397affd, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x201a90f9, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x42410)) returned 1
[0153.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee44) returned 1
[0153.104] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Outlook Files\\achoo@gdllo.de.pst.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\outlook files\\achoo@gdllo.de.pst.coom")) returned 1
[0153.105] CoTaskMemAlloc (cb=0x20c) returned 0x6c0300
[0153.105] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x6c0300 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Pictures") returned 0x0
[0153.107] CoTaskMemFree (pv=0x6c0300)
[0153.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x19e9dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e
[0153.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1
[0153.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e
[0153.107] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", lpFilePart=0x0) returned 0x1f
[0153.107] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfca7f5c1, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfca7f5c1, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6905e0
[0153.107] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfca7f5c1, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfca7f5c1, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0153.108] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x665ace0, ftCreationTime.dwHighDateTime=0x1d824ef, ftLastAccessTime.dwLowDateTime=0xfbc78c40, ftLastAccessTime.dwHighDateTime=0x1d8299e, ftLastWriteTime.dwLowDateTime=0xfbc78c40, ftLastWriteTime.dwHighDateTime=0x1d8299e, nFileSizeHigh=0x0, nFileSizeLow=0x12fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AkGZ7RwHa9JQW9htg8.jpg", cAlternateFileName="0AKGZ7~1.JPG")) returned 1
[0153.108] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd248e2b0, ftCreationTime.dwHighDateTime=0x1d81e18, ftLastAccessTime.dwLowDateTime=0x366706a0, ftLastAccessTime.dwHighDateTime=0x1d825cb, ftLastWriteTime.dwLowDateTime=0x366706a0, ftLastWriteTime.dwHighDateTime=0x1d825cb, nFileSizeHigh=0x0, nFileSizeLow=0x81ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="1XcD0L9HgO vAf jK.jpg", cAlternateFileName="1XCD0L~1.JPG")) returned 1
[0153.108] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6514d3c0, ftCreationTime.dwHighDateTime=0x1d81f53, ftLastAccessTime.dwLowDateTime=0x213e46e0, ftLastAccessTime.dwHighDateTime=0x1d826e7, ftLastWriteTime.dwLowDateTime=0x213e46e0, ftLastWriteTime.dwHighDateTime=0x1d826e7, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="6HEzLSBE7gYZeO.jpg", cAlternateFileName="6HEZLS~1.JPG")) returned 1
[0153.108] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x838492a0, ftCreationTime.dwHighDateTime=0x1d82219, ftLastAccessTime.dwLowDateTime=0x17efee10, ftLastAccessTime.dwHighDateTime=0x1d826d1, ftLastWriteTime.dwLowDateTime=0x17efee10, ftLastWriteTime.dwHighDateTime=0x1d826d1, nFileSizeHigh=0x0, nFileSizeLow=0xba29, dwReserved0=0x0, dwReserved1=0x0, cFileName="6xK8yFHYt9NwJGM.jpg", cAlternateFileName="6XK8YF~1.JPG")) returned 1
[0153.108] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8d4b30, ftCreationTime.dwHighDateTime=0x1d82066, ftLastAccessTime.dwLowDateTime=0x943c22d0, ftLastAccessTime.dwHighDateTime=0x1d824b1, ftLastWriteTime.dwLowDateTime=0x943c22d0, ftLastWriteTime.dwHighDateTime=0x1d824b1, nFileSizeHigh=0x0, nFileSizeLow=0x7b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="7WI2.gif", cAlternateFileName="")) returned 1
[0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe33cf450, ftCreationTime.dwHighDateTime=0x1d81c4a, ftLastAccessTime.dwLowDateTime=0x1e749d90, ftLastAccessTime.dwHighDateTime=0x1d81faa, ftLastWriteTime.dwLowDateTime=0x1e749d90, ftLastWriteTime.dwHighDateTime=0x1d81faa, nFileSizeHigh=0x0, nFileSizeLow=0xa79e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Jr0lXZI.gif", cAlternateFileName="")) returned 1
[0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59967750, ftCreationTime.dwHighDateTime=0x1d824ea, ftLastAccessTime.dwLowDateTime=0x102d8670, ftLastAccessTime.dwHighDateTime=0x1d8296e, ftLastWriteTime.dwLowDateTime=0x102d8670, ftLastWriteTime.dwHighDateTime=0x1d8296e, nFileSizeHigh=0x0, nFileSizeLow=0xc75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8YcKzqOL.png", cAlternateFileName="")) returned 1
[0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6540fd0, ftCreationTime.dwHighDateTime=0x1d82819, ftLastAccessTime.dwLowDateTime=0x27eca910, ftLastAccessTime.dwHighDateTime=0x1d828c1, ftLastWriteTime.dwLowDateTime=0x27eca910, ftLastWriteTime.dwHighDateTime=0x1d828c1, nFileSizeHigh=0x0, nFileSizeLow=0x9070, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Iwim433q.gif", cAlternateFileName="9IWIM4~1.GIF")) returned 1
[0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90154f0, ftCreationTime.dwHighDateTime=0x1d82895, ftLastAccessTime.dwLowDateTime=0xa483c370, ftLastAccessTime.dwHighDateTime=0x1d82a18, ftLastWriteTime.dwLowDateTime=0xa483c370, ftLastWriteTime.dwHighDateTime=0x1d82a18, nFileSizeHigh=0x0, nFileSizeLow=0x111e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9pPtv35.gif", cAlternateFileName="")) returned 1
[0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebdfd90, ftCreationTime.dwHighDateTime=0x1d81b9c, ftLastAccessTime.dwLowDateTime=0xcaae11a0, ftLastAccessTime.dwHighDateTime=0x1d82526, ftLastWriteTime.dwLowDateTime=0xcaae11a0, ftLastWriteTime.dwHighDateTime=0x1d82526, nFileSizeHigh=0x0, nFileSizeLow=0x11d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-lzQ.gif", cAlternateFileName="")) returned 1
[0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f16bd0, ftCreationTime.dwHighDateTime=0x1d828f6, ftLastAccessTime.dwLowDateTime=0xd4b33690, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0xd4b33690, ftLastWriteTime.dwHighDateTime=0x1d8298a, nFileSizeHigh=0x0, nFileSizeLow=0xbdbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="b4zTcHI.png", cAlternateFileName="")) returned 1
[0153.109] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbebb9f0, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0xc4662480, ftLastAccessTime.dwHighDateTime=0x1d825e0, ftLastWriteTime.dwLowDateTime=0xc4662480, ftLastWriteTime.dwHighDateTime=0x1d825e0, nFileSizeHigh=0x0, nFileSizeLow=0xa145, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreSk RqWy7z.png", cAlternateFileName="BRESKR~1.PNG")) returned 1
[0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528f0920, ftCreationTime.dwHighDateTime=0x1d81c40, ftLastAccessTime.dwLowDateTime=0xe0b75bb0, ftLastAccessTime.dwHighDateTime=0x1d8284f, ftLastWriteTime.dwLowDateTime=0xe0b75bb0, ftLastWriteTime.dwHighDateTime=0x1d8284f, nFileSizeHigh=0x0, nFileSizeLow=0xc7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRJpjfC.png", cAlternateFileName="")) returned 1
[0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1
[0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fa0300, ftCreationTime.dwHighDateTime=0x1d82618, ftLastAccessTime.dwLowDateTime=0xcd9fa800, ftLastAccessTime.dwHighDateTime=0x1d82973, ftLastWriteTime.dwLowDateTime=0xcd9fa800, ftLastWriteTime.dwHighDateTime=0x1d82973, nFileSizeHigh=0x0, nFileSizeLow=0x3a23, dwReserved0=0x0, dwReserved1=0x0, cFileName="d-XNPCTgc1Q9.png", cAlternateFileName="D-XNPC~1.PNG")) returned 1
[0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61cc68e0, ftCreationTime.dwHighDateTime=0x1d81f3a, ftLastAccessTime.dwLowDateTime=0x654ad800, ftLastAccessTime.dwHighDateTime=0x1d8203c, ftLastWriteTime.dwLowDateTime=0x654ad800, ftLastWriteTime.dwHighDateTime=0x1d8203c, nFileSizeHigh=0x0, nFileSizeLow=0x6cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="EzYS-.gif", cAlternateFileName="")) returned 1
[0153.110] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f6f0a0, ftCreationTime.dwHighDateTime=0x1d8227b, ftLastAccessTime.dwLowDateTime=0x17e3bb80, ftLastAccessTime.dwHighDateTime=0x1d828b2, ftLastWriteTime.dwLowDateTime=0x17e3bb80, ftLastWriteTime.dwHighDateTime=0x1d828b2, nFileSizeHigh=0x0, nFileSizeLow=0x107e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gSIkAFh.bmp", cAlternateFileName="")) returned 1
[0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b7400, ftCreationTime.dwHighDateTime=0x1d81d2b, ftLastAccessTime.dwLowDateTime=0xdec8e540, ftLastAccessTime.dwHighDateTime=0x1d82867, ftLastWriteTime.dwLowDateTime=0xdec8e540, ftLastWriteTime.dwHighDateTime=0x1d82867, nFileSizeHigh=0x0, nFileSizeLow=0x17783, dwReserved0=0x0, dwReserved1=0x0, cFileName="gXgbf6roC6Lb.jpg", cAlternateFileName="GXGBF6~1.JPG")) returned 1
[0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7daed200, ftCreationTime.dwHighDateTime=0x1d827e6, ftLastAccessTime.dwLowDateTime=0xe2a8d900, ftLastAccessTime.dwHighDateTime=0x1d8282f, ftLastWriteTime.dwLowDateTime=0xe2a8d900, ftLastWriteTime.dwHighDateTime=0x1d8282f, nFileSizeHigh=0x0, nFileSizeLow=0x1391a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hlxInIph.bmp", cAlternateFileName="")) returned 1
[0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dce0530, ftCreationTime.dwHighDateTime=0x1d826a6, ftLastAccessTime.dwLowDateTime=0x646692d0, ftLastAccessTime.dwHighDateTime=0x1d8289d, ftLastWriteTime.dwLowDateTime=0x646692d0, ftLastWriteTime.dwHighDateTime=0x1d8289d, nFileSizeHigh=0x0, nFileSizeLow=0x9c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="I6Fm_t84SE.png", cAlternateFileName="I6FM_T~1.PNG")) returned 1
[0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde0b0ec0, ftCreationTime.dwHighDateTime=0x1d8258e, ftLastAccessTime.dwLowDateTime=0x2e000b40, ftLastAccessTime.dwHighDateTime=0x1d82910, ftLastWriteTime.dwLowDateTime=0x2e000b40, ftLastWriteTime.dwHighDateTime=0x1d82910, nFileSizeHigh=0x0, nFileSizeLow=0x16d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ivsui27SVr1Y3.jpg", cAlternateFileName="IVSUI2~1.JPG")) returned 1
[0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35487f0, ftCreationTime.dwHighDateTime=0x1d827a3, ftLastAccessTime.dwLowDateTime=0xd5ae6b0, ftLastAccessTime.dwHighDateTime=0x1d82877, ftLastWriteTime.dwLowDateTime=0xd5ae6b0, ftLastWriteTime.dwHighDateTime=0x1d82877, nFileSizeHigh=0x0, nFileSizeLow=0xdc9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IWi uLS5p7Z7.gif", cAlternateFileName="IWIULS~1.GIF")) returned 1
[0153.111] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382b61d0, ftCreationTime.dwHighDateTime=0x1d8259d, ftLastAccessTime.dwLowDateTime=0x9f502390, ftLastAccessTime.dwHighDateTime=0x1d82800, ftLastWriteTime.dwLowDateTime=0x9f502390, ftLastWriteTime.dwHighDateTime=0x1d82800, nFileSizeHigh=0x0, nFileSizeLow=0x4b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="kWCT8U0903RyGLzL7N.gif", cAlternateFileName="KWCT8U~1.GIF")) returned 1
[0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16116470, ftCreationTime.dwHighDateTime=0x1d8200a, ftLastAccessTime.dwLowDateTime=0x96f1bb50, ftLastAccessTime.dwHighDateTime=0x1d825c1, ftLastWriteTime.dwLowDateTime=0x96f1bb50, ftLastWriteTime.dwHighDateTime=0x1d825c1, nFileSizeHigh=0x0, nFileSizeLow=0x13230, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsOQhqoN27oebZQi8.jpg", cAlternateFileName="LSOQHQ~1.JPG")) returned 1
[0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2a9c50, ftCreationTime.dwHighDateTime=0x1d81a54, ftLastAccessTime.dwLowDateTime=0x941f4030, ftLastAccessTime.dwHighDateTime=0x1d82078, ftLastWriteTime.dwLowDateTime=0x941f4030, ftLastWriteTime.dwHighDateTime=0x1d82078, nFileSizeHigh=0x0, nFileSizeLow=0xfa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="lWibP.gif", cAlternateFileName="")) returned 1
[0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb95b0, ftCreationTime.dwHighDateTime=0x1d821be, ftLastAccessTime.dwLowDateTime=0x866ed1f0, ftLastAccessTime.dwHighDateTime=0x1d82274, ftLastWriteTime.dwLowDateTime=0x866ed1f0, ftLastWriteTime.dwHighDateTime=0x1d82274, nFileSizeHigh=0x0, nFileSizeLow=0x12837, dwReserved0=0x0, dwReserved1=0x0, cFileName="mi45QG6WK.bmp", cAlternateFileName="MI45QG~1.BMP")) returned 1
[0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17995170, ftCreationTime.dwHighDateTime=0x1d81df0, ftLastAccessTime.dwLowDateTime=0x310f83c0, ftLastAccessTime.dwHighDateTime=0x1d81e10, ftLastWriteTime.dwLowDateTime=0x310f83c0, ftLastWriteTime.dwHighDateTime=0x1d81e10, nFileSizeHigh=0x0, nFileSizeLow=0x131f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mJaL9VXieT_.jpg", cAlternateFileName="MJAL9V~1.JPG")) returned 1
[0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6eb750, ftCreationTime.dwHighDateTime=0x1d8299b, ftLastAccessTime.dwLowDateTime=0x43267d80, ftLastAccessTime.dwHighDateTime=0x1d82a17, ftLastWriteTime.dwLowDateTime=0x43267d80, ftLastWriteTime.dwHighDateTime=0x1d82a17, nFileSizeHigh=0x0, nFileSizeLow=0xb385, dwReserved0=0x0, dwReserved1=0x0, cFileName="N7eAuVXdYrrsb7gqOWk.gif", cAlternateFileName="N7EAUV~1.GIF")) returned 1
[0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf90a3270, ftCreationTime.dwHighDateTime=0x1d81d94, ftLastAccessTime.dwLowDateTime=0xdbb79470, ftLastAccessTime.dwHighDateTime=0x1d81f91, ftLastWriteTime.dwLowDateTime=0xdbb79470, ftLastWriteTime.dwHighDateTime=0x1d81f91, nFileSizeHigh=0x0, nFileSizeLow=0xc88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLit5D.bmp", cAlternateFileName="")) returned 1
[0153.112] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4844e550, ftCreationTime.dwHighDateTime=0x1d81ae4, ftLastAccessTime.dwLowDateTime=0xe15bdb00, ftLastAccessTime.dwHighDateTime=0x1d81f39, ftLastWriteTime.dwLowDateTime=0xe15bdb00, ftLastWriteTime.dwHighDateTime=0x1d81f39, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="prgQYDqfEtZPsUF.bmp", cAlternateFileName="PRGQYD~1.BMP")) returned 1
[0153.114] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1
[0153.114] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1906ebb0, ftCreationTime.dwHighDateTime=0x1d82676, ftLastAccessTime.dwLowDateTime=0xa2a90710, ftLastAccessTime.dwHighDateTime=0x1d829b7, ftLastWriteTime.dwLowDateTime=0xa2a90710, ftLastWriteTime.dwHighDateTime=0x1d829b7, nFileSizeHigh=0x0, nFileSizeLow=0x6992, dwReserved0=0x0, dwReserved1=0x0, cFileName="srPT.bmp", cAlternateFileName="")) returned 1
[0153.115] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae76680, ftCreationTime.dwHighDateTime=0x1d827e5, ftLastAccessTime.dwLowDateTime=0xfb7a2390, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0xfb7a2390, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x6ebb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssZyCkQ2_.png", cAlternateFileName="SSZYCK~1.PNG")) returned 1
[0153.115] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5cf6670, ftCreationTime.dwHighDateTime=0x1d81baa, ftLastAccessTime.dwLowDateTime=0x4a155b70, ftLastAccessTime.dwHighDateTime=0x1d823eb, ftLastWriteTime.dwLowDateTime=0x4a155b70, ftLastWriteTime.dwHighDateTime=0x1d823eb, nFileSizeHigh=0x0, nFileSizeLow=0x40be, dwReserved0=0x0, dwReserved1=0x0, cFileName="sy8Zc6o0W2Dpzb.jpg", cAlternateFileName="SY8ZC6~1.JPG")) returned 1
[0153.115] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea8680, ftCreationTime.dwHighDateTime=0x1d81c3d, ftLastAccessTime.dwLowDateTime=0x53695f10, ftLastAccessTime.dwHighDateTime=0x1d8228c, ftLastWriteTime.dwLowDateTime=0x53695f10, ftLastWriteTime.dwHighDateTime=0x1d8228c, nFileSizeHigh=0x0, nFileSizeLow=0x14dce, dwReserved0=0x0, dwReserved1=0x0, cFileName="thhlqm_vXfrhAkJgqh4.bmp", cAlternateFileName="THHLQM~1.BMP")) returned 1
[0153.115] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dd84b0, ftCreationTime.dwHighDateTime=0x1d81f2c, ftLastAccessTime.dwLowDateTime=0xb3842800, ftLastAccessTime.dwHighDateTime=0x1d8228f, ftLastWriteTime.dwLowDateTime=0xb3842800, ftLastWriteTime.dwHighDateTime=0x1d8228f, nFileSizeHigh=0x0, nFileSizeLow=0xc6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tq-YO c2w6Tz7VNGz.bmp", cAlternateFileName="TQ-YOC~1.BMP")) returned 1
[0153.115] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa9b3c0, ftCreationTime.dwHighDateTime=0x1d81d89, ftLastAccessTime.dwLowDateTime=0x66c4d260, ftLastAccessTime.dwHighDateTime=0x1d822f0, ftLastWriteTime.dwLowDateTime=0x66c4d260, ftLastWriteTime.dwHighDateTime=0x1d822f0, nFileSizeHigh=0x0, nFileSizeLow=0xd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vmb OG1vu5V_PXk.png", cAlternateFileName="VMBOG1~1.PNG")) returned 1
[0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d443bb0, ftCreationTime.dwHighDateTime=0x1d8223a, ftLastAccessTime.dwLowDateTime=0xeebefd90, ftLastAccessTime.dwHighDateTime=0x1d823d5, ftLastWriteTime.dwLowDateTime=0xeebefd90, ftLastWriteTime.dwHighDateTime=0x1d823d5, nFileSizeHigh=0x0, nFileSizeLow=0xa0b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="wMiQ1fW9ts.gif", cAlternateFileName="WMIQ1F~1.GIF")) returned 1
[0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x346fc890, ftCreationTime.dwHighDateTime=0x1d822ac, ftLastAccessTime.dwLowDateTime=0xd286edf0, ftLastAccessTime.dwHighDateTime=0x1d8285c, ftLastWriteTime.dwLowDateTime=0xd286edf0, ftLastWriteTime.dwHighDateTime=0x1d8285c, nFileSizeHigh=0x0, nFileSizeLow=0x5ed7, dwReserved0=0x0, dwReserved1=0x0, cFileName="X1UMFrp.gif", cAlternateFileName="")) returned 1
[0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148ccbf0, ftCreationTime.dwHighDateTime=0x1d8283c, ftLastAccessTime.dwLowDateTime=0xd5db9450, ftLastAccessTime.dwHighDateTime=0x1d82966, ftLastWriteTime.dwLowDateTime=0xd5db9450, ftLastWriteTime.dwHighDateTime=0x1d82966, nFileSizeHigh=0x0, nFileSizeLow=0x11589, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFGLMn64yPgu2VdKY.gif", cAlternateFileName="XFGLMN~1.GIF")) returned 1
[0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3ae720, ftCreationTime.dwHighDateTime=0x1d820f5, ftLastAccessTime.dwLowDateTime=0x88ac5290, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0x88ac5290, ftLastWriteTime.dwHighDateTime=0x1d8298a, nFileSizeHigh=0x0, nFileSizeLow=0x28b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZfAtYXdgQ7TzJo4.bmp", cAlternateFileName="ZFATYX~1.BMP")) returned 1
[0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df1b940, ftCreationTime.dwHighDateTime=0x1d819db, ftLastAccessTime.dwLowDateTime=0x2ff12ab0, ftLastAccessTime.dwHighDateTime=0x1d81ccc, ftLastWriteTime.dwLowDateTime=0x2ff12ab0, ftLastWriteTime.dwHighDateTime=0x1d81ccc, nFileSizeHigh=0x0, nFileSizeLow=0x6c49, dwReserved0=0x0, dwReserved1=0x0, cFileName="_LbBOR Qp.bmp", cAlternateFileName="_LBBOR~1.BMP")) returned 1
[0153.116] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0153.116] FindClose (in: hFindFile=0x6905e0 | out: hFindFile=0x6905e0) returned 1
[0153.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1
[0153.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1
[0153.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ef08) returned 1
[0153.117] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures", nBufferLength=0x105, lpBuffer=0x19ea10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures", lpFilePart=0x0) returned 0x1e
[0153.117] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", nBufferLength=0x105, lpBuffer=0x19e9e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", lpFilePart=0x0) returned 0x1f
[0153.117] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\*", lpFindFileData=0x19ec30 | out: lpFindFileData=0x19ec30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfca7f5c1, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfca7f5c1, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6905e0
[0153.117] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xfca7f5c1, ftLastAccessTime.dwHighDateTime=0x1d82a28, ftLastWriteTime.dwLowDateTime=0xfca7f5c1, ftLastWriteTime.dwHighDateTime=0x1d82a28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0153.118] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x665ace0, ftCreationTime.dwHighDateTime=0x1d824ef, ftLastAccessTime.dwLowDateTime=0xfbc78c40, ftLastAccessTime.dwHighDateTime=0x1d8299e, ftLastWriteTime.dwLowDateTime=0xfbc78c40, ftLastWriteTime.dwHighDateTime=0x1d8299e, nFileSizeHigh=0x0, nFileSizeLow=0x12fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AkGZ7RwHa9JQW9htg8.jpg", cAlternateFileName="0AKGZ7~1.JPG")) returned 1
[0153.118] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd248e2b0, ftCreationTime.dwHighDateTime=0x1d81e18, ftLastAccessTime.dwLowDateTime=0x366706a0, ftLastAccessTime.dwHighDateTime=0x1d825cb, ftLastWriteTime.dwLowDateTime=0x366706a0, ftLastWriteTime.dwHighDateTime=0x1d825cb, nFileSizeHigh=0x0, nFileSizeLow=0x81ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="1XcD0L9HgO vAf jK.jpg", cAlternateFileName="1XCD0L~1.JPG")) returned 1
[0153.118] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6514d3c0, ftCreationTime.dwHighDateTime=0x1d81f53, ftLastAccessTime.dwLowDateTime=0x213e46e0, ftLastAccessTime.dwHighDateTime=0x1d826e7, ftLastWriteTime.dwLowDateTime=0x213e46e0, ftLastWriteTime.dwHighDateTime=0x1d826e7, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="6HEzLSBE7gYZeO.jpg", cAlternateFileName="6HEZLS~1.JPG")) returned 1
[0153.118] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x838492a0, ftCreationTime.dwHighDateTime=0x1d82219, ftLastAccessTime.dwLowDateTime=0x17efee10, ftLastAccessTime.dwHighDateTime=0x1d826d1, ftLastWriteTime.dwLowDateTime=0x17efee10, ftLastWriteTime.dwHighDateTime=0x1d826d1, nFileSizeHigh=0x0, nFileSizeLow=0xba29, dwReserved0=0x0, dwReserved1=0x0, cFileName="6xK8yFHYt9NwJGM.jpg", cAlternateFileName="6XK8YF~1.JPG")) returned 1
[0153.118] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8d4b30, ftCreationTime.dwHighDateTime=0x1d82066, ftLastAccessTime.dwLowDateTime=0x943c22d0, ftLastAccessTime.dwHighDateTime=0x1d824b1, ftLastWriteTime.dwLowDateTime=0x943c22d0, ftLastWriteTime.dwHighDateTime=0x1d824b1, nFileSizeHigh=0x0, nFileSizeLow=0x7b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="7WI2.gif", cAlternateFileName="")) returned 1
[0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe33cf450, ftCreationTime.dwHighDateTime=0x1d81c4a, ftLastAccessTime.dwLowDateTime=0x1e749d90, ftLastAccessTime.dwHighDateTime=0x1d81faa, ftLastWriteTime.dwLowDateTime=0x1e749d90, ftLastWriteTime.dwHighDateTime=0x1d81faa, nFileSizeHigh=0x0, nFileSizeLow=0xa79e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8Jr0lXZI.gif", cAlternateFileName="")) returned 1
[0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59967750, ftCreationTime.dwHighDateTime=0x1d824ea, ftLastAccessTime.dwLowDateTime=0x102d8670, ftLastAccessTime.dwHighDateTime=0x1d8296e, ftLastWriteTime.dwLowDateTime=0x102d8670, ftLastWriteTime.dwHighDateTime=0x1d8296e, nFileSizeHigh=0x0, nFileSizeLow=0xc75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="8YcKzqOL.png", cAlternateFileName="")) returned 1
[0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6540fd0, ftCreationTime.dwHighDateTime=0x1d82819, ftLastAccessTime.dwLowDateTime=0x27eca910, ftLastAccessTime.dwHighDateTime=0x1d828c1, ftLastWriteTime.dwLowDateTime=0x27eca910, ftLastWriteTime.dwHighDateTime=0x1d828c1, nFileSizeHigh=0x0, nFileSizeLow=0x9070, dwReserved0=0x0, dwReserved1=0x0, cFileName="9Iwim433q.gif", cAlternateFileName="9IWIM4~1.GIF")) returned 1
[0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90154f0, ftCreationTime.dwHighDateTime=0x1d82895, ftLastAccessTime.dwLowDateTime=0xa483c370, ftLastAccessTime.dwHighDateTime=0x1d82a18, ftLastWriteTime.dwLowDateTime=0xa483c370, ftLastWriteTime.dwHighDateTime=0x1d82a18, nFileSizeHigh=0x0, nFileSizeLow=0x111e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9pPtv35.gif", cAlternateFileName="")) returned 1
[0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebdfd90, ftCreationTime.dwHighDateTime=0x1d81b9c, ftLastAccessTime.dwLowDateTime=0xcaae11a0, ftLastAccessTime.dwHighDateTime=0x1d82526, ftLastWriteTime.dwLowDateTime=0xcaae11a0, ftLastWriteTime.dwHighDateTime=0x1d82526, nFileSizeHigh=0x0, nFileSizeLow=0x11d46, dwReserved0=0x0, dwReserved1=0x0, cFileName="b-lzQ.gif", cAlternateFileName="")) returned 1
[0153.119] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f16bd0, ftCreationTime.dwHighDateTime=0x1d828f6, ftLastAccessTime.dwLowDateTime=0xd4b33690, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0xd4b33690, ftLastWriteTime.dwHighDateTime=0x1d8298a, nFileSizeHigh=0x0, nFileSizeLow=0xbdbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="b4zTcHI.png", cAlternateFileName="")) returned 1
[0153.120] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbebb9f0, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0xc4662480, ftLastAccessTime.dwHighDateTime=0x1d825e0, ftLastWriteTime.dwLowDateTime=0xc4662480, ftLastWriteTime.dwHighDateTime=0x1d825e0, nFileSizeHigh=0x0, nFileSizeLow=0xa145, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreSk RqWy7z.png", cAlternateFileName="BRESKR~1.PNG")) returned 1
[0153.120] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528f0920, ftCreationTime.dwHighDateTime=0x1d81c40, ftLastAccessTime.dwLowDateTime=0xe0b75bb0, ftLastAccessTime.dwHighDateTime=0x1d8284f, ftLastWriteTime.dwLowDateTime=0xe0b75bb0, ftLastWriteTime.dwHighDateTime=0x1d8284f, nFileSizeHigh=0x0, nFileSizeLow=0xc7d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRJpjfC.png", cAlternateFileName="")) returned 1
[0153.120] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1
[0153.120] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fa0300, ftCreationTime.dwHighDateTime=0x1d82618, ftLastAccessTime.dwLowDateTime=0xcd9fa800, ftLastAccessTime.dwHighDateTime=0x1d82973, ftLastWriteTime.dwLowDateTime=0xcd9fa800, ftLastWriteTime.dwHighDateTime=0x1d82973, nFileSizeHigh=0x0, nFileSizeLow=0x3a23, dwReserved0=0x0, dwReserved1=0x0, cFileName="d-XNPCTgc1Q9.png", cAlternateFileName="D-XNPC~1.PNG")) returned 1
[0153.120] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0153.121] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61cc68e0, ftCreationTime.dwHighDateTime=0x1d81f3a, ftLastAccessTime.dwLowDateTime=0x654ad800, ftLastAccessTime.dwHighDateTime=0x1d8203c, ftLastWriteTime.dwLowDateTime=0x654ad800, ftLastWriteTime.dwHighDateTime=0x1d8203c, nFileSizeHigh=0x0, nFileSizeLow=0x6cce, dwReserved0=0x0, dwReserved1=0x0, cFileName="EzYS-.gif", cAlternateFileName="")) returned 1
[0153.121] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f6f0a0, ftCreationTime.dwHighDateTime=0x1d8227b, ftLastAccessTime.dwLowDateTime=0x17e3bb80, ftLastAccessTime.dwHighDateTime=0x1d828b2, ftLastWriteTime.dwLowDateTime=0x17e3bb80, ftLastWriteTime.dwHighDateTime=0x1d828b2, nFileSizeHigh=0x0, nFileSizeLow=0x107e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gSIkAFh.bmp", cAlternateFileName="")) returned 1
[0153.121] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b7400, ftCreationTime.dwHighDateTime=0x1d81d2b, ftLastAccessTime.dwLowDateTime=0xdec8e540, ftLastAccessTime.dwHighDateTime=0x1d82867, ftLastWriteTime.dwLowDateTime=0xdec8e540, ftLastWriteTime.dwHighDateTime=0x1d82867, nFileSizeHigh=0x0, nFileSizeLow=0x17783, dwReserved0=0x0, dwReserved1=0x0, cFileName="gXgbf6roC6Lb.jpg", cAlternateFileName="GXGBF6~1.JPG")) returned 1
[0153.121] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7daed200, ftCreationTime.dwHighDateTime=0x1d827e6, ftLastAccessTime.dwLowDateTime=0xe2a8d900, ftLastAccessTime.dwHighDateTime=0x1d8282f, ftLastWriteTime.dwLowDateTime=0xe2a8d900, ftLastWriteTime.dwHighDateTime=0x1d8282f, nFileSizeHigh=0x0, nFileSizeLow=0x1391a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hlxInIph.bmp", cAlternateFileName="")) returned 1
[0153.121] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dce0530, ftCreationTime.dwHighDateTime=0x1d826a6, ftLastAccessTime.dwLowDateTime=0x646692d0, ftLastAccessTime.dwHighDateTime=0x1d8289d, ftLastWriteTime.dwLowDateTime=0x646692d0, ftLastWriteTime.dwHighDateTime=0x1d8289d, nFileSizeHigh=0x0, nFileSizeLow=0x9c9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="I6Fm_t84SE.png", cAlternateFileName="I6FM_T~1.PNG")) returned 1
[0153.122] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde0b0ec0, ftCreationTime.dwHighDateTime=0x1d8258e, ftLastAccessTime.dwLowDateTime=0x2e000b40, ftLastAccessTime.dwHighDateTime=0x1d82910, ftLastWriteTime.dwLowDateTime=0x2e000b40, ftLastWriteTime.dwHighDateTime=0x1d82910, nFileSizeHigh=0x0, nFileSizeLow=0x16d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ivsui27SVr1Y3.jpg", cAlternateFileName="IVSUI2~1.JPG")) returned 1
[0153.122] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe35487f0, ftCreationTime.dwHighDateTime=0x1d827a3, ftLastAccessTime.dwLowDateTime=0xd5ae6b0, ftLastAccessTime.dwHighDateTime=0x1d82877, ftLastWriteTime.dwLowDateTime=0xd5ae6b0, ftLastWriteTime.dwHighDateTime=0x1d82877, nFileSizeHigh=0x0, nFileSizeLow=0xdc9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IWi uLS5p7Z7.gif", cAlternateFileName="IWIULS~1.GIF")) returned 1
[0153.122] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x382b61d0, ftCreationTime.dwHighDateTime=0x1d8259d, ftLastAccessTime.dwLowDateTime=0x9f502390, ftLastAccessTime.dwHighDateTime=0x1d82800, ftLastWriteTime.dwLowDateTime=0x9f502390, ftLastWriteTime.dwHighDateTime=0x1d82800, nFileSizeHigh=0x0, nFileSizeLow=0x4b08, dwReserved0=0x0, dwReserved1=0x0, cFileName="kWCT8U0903RyGLzL7N.gif", cAlternateFileName="KWCT8U~1.GIF")) returned 1
[0153.122] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16116470, ftCreationTime.dwHighDateTime=0x1d8200a, ftLastAccessTime.dwLowDateTime=0x96f1bb50, ftLastAccessTime.dwHighDateTime=0x1d825c1, ftLastWriteTime.dwLowDateTime=0x96f1bb50, ftLastWriteTime.dwHighDateTime=0x1d825c1, nFileSizeHigh=0x0, nFileSizeLow=0x13230, dwReserved0=0x0, dwReserved1=0x0, cFileName="lsOQhqoN27oebZQi8.jpg", cAlternateFileName="LSOQHQ~1.JPG")) returned 1
[0153.122] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf2a9c50, ftCreationTime.dwHighDateTime=0x1d81a54, ftLastAccessTime.dwLowDateTime=0x941f4030, ftLastAccessTime.dwHighDateTime=0x1d82078, ftLastWriteTime.dwLowDateTime=0x941f4030, ftLastWriteTime.dwHighDateTime=0x1d82078, nFileSizeHigh=0x0, nFileSizeLow=0xfa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="lWibP.gif", cAlternateFileName="")) returned 1
[0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb95b0, ftCreationTime.dwHighDateTime=0x1d821be, ftLastAccessTime.dwLowDateTime=0x866ed1f0, ftLastAccessTime.dwHighDateTime=0x1d82274, ftLastWriteTime.dwLowDateTime=0x866ed1f0, ftLastWriteTime.dwHighDateTime=0x1d82274, nFileSizeHigh=0x0, nFileSizeLow=0x12837, dwReserved0=0x0, dwReserved1=0x0, cFileName="mi45QG6WK.bmp", cAlternateFileName="MI45QG~1.BMP")) returned 1
[0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17995170, ftCreationTime.dwHighDateTime=0x1d81df0, ftLastAccessTime.dwLowDateTime=0x310f83c0, ftLastAccessTime.dwHighDateTime=0x1d81e10, ftLastWriteTime.dwLowDateTime=0x310f83c0, ftLastWriteTime.dwHighDateTime=0x1d81e10, nFileSizeHigh=0x0, nFileSizeLow=0x131f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mJaL9VXieT_.jpg", cAlternateFileName="MJAL9V~1.JPG")) returned 1
[0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c6eb750, ftCreationTime.dwHighDateTime=0x1d8299b, ftLastAccessTime.dwLowDateTime=0x43267d80, ftLastAccessTime.dwHighDateTime=0x1d82a17, ftLastWriteTime.dwLowDateTime=0x43267d80, ftLastWriteTime.dwHighDateTime=0x1d82a17, nFileSizeHigh=0x0, nFileSizeLow=0xb385, dwReserved0=0x0, dwReserved1=0x0, cFileName="N7eAuVXdYrrsb7gqOWk.gif", cAlternateFileName="N7EAUV~1.GIF")) returned 1
[0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf90a3270, ftCreationTime.dwHighDateTime=0x1d81d94, ftLastAccessTime.dwLowDateTime=0xdbb79470, ftLastAccessTime.dwHighDateTime=0x1d81f91, ftLastWriteTime.dwLowDateTime=0xdbb79470, ftLastWriteTime.dwHighDateTime=0x1d81f91, nFileSizeHigh=0x0, nFileSizeLow=0xc88d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLit5D.bmp", cAlternateFileName="")) returned 1
[0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4844e550, ftCreationTime.dwHighDateTime=0x1d81ae4, ftLastAccessTime.dwLowDateTime=0xe15bdb00, ftLastAccessTime.dwHighDateTime=0x1d81f39, ftLastWriteTime.dwLowDateTime=0xe15bdb00, ftLastWriteTime.dwHighDateTime=0x1d81f39, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="prgQYDqfEtZPsUF.bmp", cAlternateFileName="PRGQYD~1.BMP")) returned 1
[0153.123] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1
[0153.131] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1906ebb0, ftCreationTime.dwHighDateTime=0x1d82676, ftLastAccessTime.dwLowDateTime=0xa2a90710, ftLastAccessTime.dwHighDateTime=0x1d829b7, ftLastWriteTime.dwLowDateTime=0xa2a90710, ftLastWriteTime.dwHighDateTime=0x1d829b7, nFileSizeHigh=0x0, nFileSizeLow=0x6992, dwReserved0=0x0, dwReserved1=0x0, cFileName="srPT.bmp", cAlternateFileName="")) returned 1
[0153.131] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae76680, ftCreationTime.dwHighDateTime=0x1d827e5, ftLastAccessTime.dwLowDateTime=0xfb7a2390, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0xfb7a2390, ftLastWriteTime.dwHighDateTime=0x1d82a22, nFileSizeHigh=0x0, nFileSizeLow=0x6ebb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssZyCkQ2_.png", cAlternateFileName="SSZYCK~1.PNG")) returned 1
[0153.131] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5cf6670, ftCreationTime.dwHighDateTime=0x1d81baa, ftLastAccessTime.dwLowDateTime=0x4a155b70, ftLastAccessTime.dwHighDateTime=0x1d823eb, ftLastWriteTime.dwLowDateTime=0x4a155b70, ftLastWriteTime.dwHighDateTime=0x1d823eb, nFileSizeHigh=0x0, nFileSizeLow=0x40be, dwReserved0=0x0, dwReserved1=0x0, cFileName="sy8Zc6o0W2Dpzb.jpg", cAlternateFileName="SY8ZC6~1.JPG")) returned 1
[0153.131] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea8680, ftCreationTime.dwHighDateTime=0x1d81c3d, ftLastAccessTime.dwLowDateTime=0x53695f10, ftLastAccessTime.dwHighDateTime=0x1d8228c, ftLastWriteTime.dwLowDateTime=0x53695f10, ftLastWriteTime.dwHighDateTime=0x1d8228c, nFileSizeHigh=0x0, nFileSizeLow=0x14dce, dwReserved0=0x0, dwReserved1=0x0, cFileName="thhlqm_vXfrhAkJgqh4.bmp", cAlternateFileName="THHLQM~1.BMP")) returned 1
[0153.131] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dd84b0, ftCreationTime.dwHighDateTime=0x1d81f2c, ftLastAccessTime.dwLowDateTime=0xb3842800, ftLastAccessTime.dwHighDateTime=0x1d8228f, ftLastWriteTime.dwLowDateTime=0xb3842800, ftLastWriteTime.dwHighDateTime=0x1d8228f, nFileSizeHigh=0x0, nFileSizeLow=0xc6cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tq-YO c2w6Tz7VNGz.bmp", cAlternateFileName="TQ-YOC~1.BMP")) returned 1
[0153.132] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa9b3c0, ftCreationTime.dwHighDateTime=0x1d81d89, ftLastAccessTime.dwLowDateTime=0x66c4d260, ftLastAccessTime.dwHighDateTime=0x1d822f0, ftLastWriteTime.dwLowDateTime=0x66c4d260, ftLastWriteTime.dwHighDateTime=0x1d822f0, nFileSizeHigh=0x0, nFileSizeLow=0xd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vmb OG1vu5V_PXk.png", cAlternateFileName="VMBOG1~1.PNG")) returned 1
[0153.132] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d443bb0, ftCreationTime.dwHighDateTime=0x1d8223a, ftLastAccessTime.dwLowDateTime=0xeebefd90, ftLastAccessTime.dwHighDateTime=0x1d823d5, ftLastWriteTime.dwLowDateTime=0xeebefd90, ftLastWriteTime.dwHighDateTime=0x1d823d5, nFileSizeHigh=0x0, nFileSizeLow=0xa0b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="wMiQ1fW9ts.gif", cAlternateFileName="WMIQ1F~1.GIF")) returned 1
[0153.132] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x346fc890, ftCreationTime.dwHighDateTime=0x1d822ac, ftLastAccessTime.dwLowDateTime=0xd286edf0, ftLastAccessTime.dwHighDateTime=0x1d8285c, ftLastWriteTime.dwLowDateTime=0xd286edf0, ftLastWriteTime.dwHighDateTime=0x1d8285c, nFileSizeHigh=0x0, nFileSizeLow=0x5ed7, dwReserved0=0x0, dwReserved1=0x0, cFileName="X1UMFrp.gif", cAlternateFileName="")) returned 1
[0153.132] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x148ccbf0, ftCreationTime.dwHighDateTime=0x1d8283c, ftLastAccessTime.dwLowDateTime=0xd5db9450, ftLastAccessTime.dwHighDateTime=0x1d82966, ftLastWriteTime.dwLowDateTime=0xd5db9450, ftLastWriteTime.dwHighDateTime=0x1d82966, nFileSizeHigh=0x0, nFileSizeLow=0x11589, dwReserved0=0x0, dwReserved1=0x0, cFileName="xFGLMn64yPgu2VdKY.gif", cAlternateFileName="XFGLMN~1.GIF")) returned 1
[0153.133] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3ae720, ftCreationTime.dwHighDateTime=0x1d820f5, ftLastAccessTime.dwLowDateTime=0x88ac5290, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0x88ac5290, ftLastWriteTime.dwHighDateTime=0x1d8298a, nFileSizeHigh=0x0, nFileSizeLow=0x28b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZfAtYXdgQ7TzJo4.bmp", cAlternateFileName="ZFATYX~1.BMP")) returned 1
[0153.133] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df1b940, ftCreationTime.dwHighDateTime=0x1d819db, ftLastAccessTime.dwLowDateTime=0x2ff12ab0, ftLastAccessTime.dwHighDateTime=0x1d81ccc, ftLastWriteTime.dwLowDateTime=0x2ff12ab0, ftLastWriteTime.dwHighDateTime=0x1d81ccc, nFileSizeHigh=0x0, nFileSizeLow=0x6c49, dwReserved0=0x0, dwReserved1=0x0, cFileName="_LbBOR Qp.bmp", cAlternateFileName="_LBBOR~1.BMP")) returned 1
[0153.133] FindNextFileW (in: hFindFile=0x6905e0, lpFindFileData=0x19ec40 | out: lpFindFileData=0x19ec40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df1b940, ftCreationTime.dwHighDateTime=0x1d819db, ftLastAccessTime.dwLowDateTime=0x2ff12ab0, ftLastAccessTime.dwHighDateTime=0x1d81ccc, ftLastWriteTime.dwLowDateTime=0x2ff12ab0, ftLastWriteTime.dwHighDateTime=0x1d81ccc, nFileSizeHigh=0x0, nFileSizeLow=0x6c49, dwReserved0=0x0, dwReserved1=0x0, cFileName="_LbBOR Qp.bmp", cAlternateFileName="_LBBOR~1.BMP")) returned 0
[0153.133] FindClose (in: hFindFile=0x6905e0 | out: hFindFile=0x6905e0) returned 1
[0153.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eec8) returned 1
[0153.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eed4) returned 1
[0153.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", lpFilePart=0x0) returned 0x36
[0153.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.134] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\0akgz7rwha9jqw9htg8.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.134] GetFileType (hFile=0x350) returned 0x1
[0153.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.134] GetFileType (hFile=0x350) returned 0x1
[0153.134] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x12fa8
[0153.134] ReadFile (in: hFile=0x350, lpBuffer=0x21e1e8c, nNumberOfBytesToRead=0x12fa8, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x21e1e8c*, lpNumberOfBytesRead=0x19eeb0*=0x12fa8, lpOverlapped=0x0) returned 1
[0153.136] CloseHandle (hObject=0x350) returned 1
[0153.203] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", lpFilePart=0x0) returned 0x36
[0153.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.203] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\0akgz7rwha9jqw9htg8.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.207] GetFileType (hFile=0x350) returned 0x1
[0153.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.207] GetFileType (hFile=0x350) returned 0x1
[0153.207] WriteFile (in: hFile=0x350, lpBuffer=0x2267ccc*, nNumberOfBytesToWrite=0x12fb0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2267ccc*, lpNumberOfBytesWritten=0x19eea0*=0x12fb0, lpOverlapped=0x0) returned 1
[0153.210] CloseHandle (hObject=0x350) returned 1
[0153.214] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg", lpFilePart=0x0) returned 0x36
[0153.214] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg.coom", lpFilePart=0x0) returned 0x3b
[0153.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.214] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\0akgz7rwha9jqw9htg8.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x665ace0, ftCreationTime.dwHighDateTime=0x1d824ef, ftLastAccessTime.dwLowDateTime=0xfbc78c40, ftLastAccessTime.dwHighDateTime=0x1d8299e, ftLastWriteTime.dwLowDateTime=0x202b5f0a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x12fb0)) returned 1
[0153.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.215] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\0akgz7rwha9jqw9htg8.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\0AkGZ7RwHa9JQW9htg8.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\0akgz7rwha9jqw9htg8.jpg.coom")) returned 1
[0153.216] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", lpFilePart=0x0) returned 0x34
[0153.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.216] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\1xcd0l9hgo vaf jk.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.216] GetFileType (hFile=0x350) returned 0x1
[0153.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.216] GetFileType (hFile=0x350) returned 0x1
[0153.216] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x81ef
[0153.216] ReadFile (in: hFile=0x350, lpBuffer=0x227b044, nNumberOfBytesToRead=0x81ef, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x227b044*, lpNumberOfBytesRead=0x19eeb0*=0x81ef, lpOverlapped=0x0) returned 1
[0153.218] CloseHandle (hObject=0x350) returned 1
[0153.299] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", lpFilePart=0x0) returned 0x34
[0153.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.299] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\1xcd0l9hgo vaf jk.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.301] GetFileType (hFile=0x350) returned 0x1
[0153.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.302] GetFileType (hFile=0x350) returned 0x1
[0153.302] WriteFile (in: hFile=0x350, lpBuffer=0x22f07b8*, nNumberOfBytesToWrite=0x81f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22f07b8*, lpNumberOfBytesWritten=0x19eea0*=0x81f0, lpOverlapped=0x0) returned 1
[0153.304] CloseHandle (hObject=0x350) returned 1
[0153.306] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg", lpFilePart=0x0) returned 0x34
[0153.306] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg.coom", lpFilePart=0x0) returned 0x39
[0153.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\1xcd0l9hgo vaf jk.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd248e2b0, ftCreationTime.dwHighDateTime=0x1d81e18, ftLastAccessTime.dwLowDateTime=0x366706a0, ftLastAccessTime.dwHighDateTime=0x1d825cb, ftLastWriteTime.dwLowDateTime=0x203971af, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x81f0)) returned 1
[0153.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.307] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\1xcd0l9hgo vaf jk.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\1XcD0L9HgO vAf jK.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\1xcd0l9hgo vaf jk.jpg.coom")) returned 1
[0153.308] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", lpFilePart=0x0) returned 0x31
[0153.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.308] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6hezlsbe7gyzeo.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.308] GetFileType (hFile=0x350) returned 0x1
[0153.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.308] GetFileType (hFile=0x350) returned 0x1
[0153.308] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x16cbe
[0153.308] ReadFile (in: hFile=0x350, lpBuffer=0x3353240, nNumberOfBytesToRead=0x16cbe, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3353240*, lpNumberOfBytesRead=0x19eeb0*=0x16cbe, lpOverlapped=0x0) returned 1
[0153.310] CloseHandle (hObject=0x350) returned 1
[0153.346] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", lpFilePart=0x0) returned 0x31
[0153.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.347] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6hezlsbe7gyzeo.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.349] GetFileType (hFile=0x350) returned 0x1
[0153.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.349] GetFileType (hFile=0x350) returned 0x1
[0153.349] WriteFile (in: hFile=0x350, lpBuffer=0x33c5240*, nNumberOfBytesToWrite=0x16cc0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x33c5240*, lpNumberOfBytesWritten=0x19eea0*=0x16cc0, lpOverlapped=0x0) returned 1
[0153.353] CloseHandle (hObject=0x350) returned 1
[0153.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg", lpFilePart=0x0) returned 0x31
[0153.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg.coom", lpFilePart=0x0) returned 0x36
[0153.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.357] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6hezlsbe7gyzeo.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6514d3c0, ftCreationTime.dwHighDateTime=0x1d81f53, ftLastAccessTime.dwLowDateTime=0x213e46e0, ftLastAccessTime.dwHighDateTime=0x1d826e7, ftLastWriteTime.dwLowDateTime=0x20412d32, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x16cc0)) returned 1
[0153.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.358] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6hezlsbe7gyzeo.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6HEzLSBE7gYZeO.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6hezlsbe7gyzeo.jpg.coom")) returned 1
[0153.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", lpFilePart=0x0) returned 0x32
[0153.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.359] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6xk8yfhyt9nwjgm.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.359] GetFileType (hFile=0x350) returned 0x1
[0153.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.359] GetFileType (hFile=0x350) returned 0x1
[0153.359] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xba29
[0153.360] ReadFile (in: hFile=0x350, lpBuffer=0x2345ea8, nNumberOfBytesToRead=0xba29, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2345ea8*, lpNumberOfBytesRead=0x19eeb0*=0xba29, lpOverlapped=0x0) returned 1
[0153.361] CloseHandle (hObject=0x350) returned 1
[0153.384] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", lpFilePart=0x0) returned 0x32
[0153.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.384] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6xk8yfhyt9nwjgm.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.386] GetFileType (hFile=0x350) returned 0x1
[0153.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.386] GetFileType (hFile=0x350) returned 0x1
[0153.386] WriteFile (in: hFile=0x350, lpBuffer=0x23b5b10*, nNumberOfBytesToWrite=0xba30, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23b5b10*, lpNumberOfBytesWritten=0x19eea0*=0xba30, lpOverlapped=0x0) returned 1
[0153.388] CloseHandle (hObject=0x350) returned 1
[0153.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg", lpFilePart=0x0) returned 0x32
[0153.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg.coom", lpFilePart=0x0) returned 0x37
[0153.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6xk8yfhyt9nwjgm.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x838492a0, ftCreationTime.dwHighDateTime=0x1d82219, ftLastAccessTime.dwLowDateTime=0x17efee10, ftLastAccessTime.dwHighDateTime=0x1d826d1, ftLastWriteTime.dwLowDateTime=0x20465cb3, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xba30)) returned 1
[0153.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.391] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6xk8yfhyt9nwjgm.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\6xK8yFHYt9NwJGM.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\6xk8yfhyt9nwjgm.jpg.coom")) returned 1
[0153.392] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", lpFilePart=0x0) returned 0x2b
[0153.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.392] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8yckzqol.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.392] GetFileType (hFile=0x350) returned 0x1
[0153.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.392] GetFileType (hFile=0x350) returned 0x1
[0153.393] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xc75e
[0153.393] ReadFile (in: hFile=0x350, lpBuffer=0x23c18ec, nNumberOfBytesToRead=0xc75e, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23c18ec*, lpNumberOfBytesRead=0x19eeb0*=0xc75e, lpOverlapped=0x0) returned 1
[0153.394] CloseHandle (hObject=0x350) returned 1
[0153.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", lpFilePart=0x0) returned 0x2b
[0153.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.457] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8yckzqol.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.459] GetFileType (hFile=0x350) returned 0x1
[0153.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.459] GetFileType (hFile=0x350) returned 0x1
[0153.459] WriteFile (in: hFile=0x350, lpBuffer=0x2241d78*, nNumberOfBytesToWrite=0xc760, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2241d78*, lpNumberOfBytesWritten=0x19eea0*=0xc760, lpOverlapped=0x0) returned 1
[0153.461] CloseHandle (hObject=0x350) returned 1
[0153.589] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png", lpFilePart=0x0) returned 0x2b
[0153.590] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png.coom", lpFilePart=0x0) returned 0x30
[0153.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8yckzqol.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59967750, ftCreationTime.dwHighDateTime=0x1d824ea, ftLastAccessTime.dwLowDateTime=0x102d8670, ftLastAccessTime.dwHighDateTime=0x1d8296e, ftLastWriteTime.dwLowDateTime=0x2064aaf2, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xc760)) returned 1
[0153.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.590] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8yckzqol.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\8YcKzqOL.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\8yckzqol.png.coom")) returned 1
[0153.591] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", lpFilePart=0x0) returned 0x2a
[0153.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.591] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\b4ztchi.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.591] GetFileType (hFile=0x350) returned 0x1
[0153.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.591] GetFileType (hFile=0x350) returned 0x1
[0153.591] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xbdbf
[0153.591] ReadFile (in: hFile=0x350, lpBuffer=0x224e854, nNumberOfBytesToRead=0xbdbf, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x224e854*, lpNumberOfBytesRead=0x19eeb0*=0xbdbf, lpOverlapped=0x0) returned 1
[0153.593] CloseHandle (hObject=0x350) returned 1
[0153.613] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", lpFilePart=0x0) returned 0x2a
[0153.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.613] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\b4ztchi.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.615] GetFileType (hFile=0x350) returned 0x1
[0153.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.615] GetFileType (hFile=0x350) returned 0x1
[0153.615] WriteFile (in: hFile=0x350, lpBuffer=0x22bf0c8*, nNumberOfBytesToWrite=0xbdc0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22bf0c8*, lpNumberOfBytesWritten=0x19eea0*=0xbdc0, lpOverlapped=0x0) returned 1
[0153.617] CloseHandle (hObject=0x350) returned 1
[0153.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png", lpFilePart=0x0) returned 0x2a
[0153.620] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png.coom", lpFilePart=0x0) returned 0x2f
[0153.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.620] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\b4ztchi.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f16bd0, ftCreationTime.dwHighDateTime=0x1d828f6, ftLastAccessTime.dwLowDateTime=0xd4b33690, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0x2069483f, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xbdc0)) returned 1
[0153.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.620] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\b4ztchi.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\b4zTcHI.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\b4ztchi.png.coom")) returned 1
[0153.621] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", lpFilePart=0x0) returned 0x2f
[0153.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.621] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\bresk rqwy7z.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.622] GetFileType (hFile=0x350) returned 0x1
[0153.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.622] GetFileType (hFile=0x350) returned 0x1
[0153.622] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xa145
[0153.622] ReadFile (in: hFile=0x350, lpBuffer=0x22cb1c4, nNumberOfBytesToRead=0xa145, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22cb1c4*, lpNumberOfBytesRead=0x19eeb0*=0xa145, lpOverlapped=0x0) returned 1
[0153.624] CloseHandle (hObject=0x350) returned 1
[0153.655] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", lpFilePart=0x0) returned 0x2f
[0153.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.655] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\bresk rqwy7z.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.658] GetFileType (hFile=0x350) returned 0x1
[0153.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.658] GetFileType (hFile=0x350) returned 0x1
[0153.658] WriteFile (in: hFile=0x350, lpBuffer=0x234a618*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x234a618*, lpNumberOfBytesWritten=0x19eea0*=0xa150, lpOverlapped=0x0) returned 1
[0153.661] CloseHandle (hObject=0x350) returned 1
[0153.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png", lpFilePart=0x0) returned 0x2f
[0153.664] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png.coom", lpFilePart=0x0) returned 0x34
[0153.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\bresk rqwy7z.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbebb9f0, ftCreationTime.dwHighDateTime=0x1d8257c, ftLastAccessTime.dwLowDateTime=0xc4662480, ftLastAccessTime.dwHighDateTime=0x1d825e0, ftLastWriteTime.dwLowDateTime=0x20700063, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xa150)) returned 1
[0153.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.664] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\bresk rqwy7z.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BreSk RqWy7z.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\bresk rqwy7z.png.coom")) returned 1
[0153.665] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", lpFilePart=0x0) returned 0x2a
[0153.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.668] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\brjpjfc.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.669] GetFileType (hFile=0x350) returned 0x1
[0153.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.669] GetFileType (hFile=0x350) returned 0x1
[0153.669] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xc7d8
[0153.669] ReadFile (in: hFile=0x350, lpBuffer=0x2354ac4, nNumberOfBytesToRead=0xc7d8, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2354ac4*, lpNumberOfBytesRead=0x19eeb0*=0xc7d8, lpOverlapped=0x0) returned 1
[0153.670] CloseHandle (hObject=0x350) returned 1
[0153.690] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", lpFilePart=0x0) returned 0x2a
[0153.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.690] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\brjpjfc.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.692] GetFileType (hFile=0x350) returned 0x1
[0153.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.692] GetFileType (hFile=0x350) returned 0x1
[0153.692] WriteFile (in: hFile=0x350, lpBuffer=0x23c7038*, nNumberOfBytesToWrite=0xc7e0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23c7038*, lpNumberOfBytesWritten=0x19eea0*=0xc7e0, lpOverlapped=0x0) returned 1
[0153.694] CloseHandle (hObject=0x350) returned 1
[0153.697] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png", lpFilePart=0x0) returned 0x2a
[0153.697] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png.coom", lpFilePart=0x0) returned 0x2f
[0153.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.697] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\brjpjfc.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x528f0920, ftCreationTime.dwHighDateTime=0x1d81c40, ftLastAccessTime.dwLowDateTime=0xe0b75bb0, ftLastAccessTime.dwHighDateTime=0x1d8284f, ftLastWriteTime.dwLowDateTime=0x20751ffd, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xc7e0)) returned 1
[0153.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.698] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\brjpjfc.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\BRJpjfC.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\brjpjfc.png.coom")) returned 1
[0153.698] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", lpFilePart=0x0) returned 0x2f
[0153.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.698] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\d-xnpctgc1q9.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.699] GetFileType (hFile=0x350) returned 0x1
[0153.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.699] GetFileType (hFile=0x350) returned 0x1
[0153.699] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x3a23
[0153.699] ReadFile (in: hFile=0x350, lpBuffer=0x23d3b54, nNumberOfBytesToRead=0x3a23, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23d3b54*, lpNumberOfBytesRead=0x19eeb0*=0x3a23, lpOverlapped=0x0) returned 1
[0153.700] CloseHandle (hObject=0x350) returned 1
[0153.762] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", lpFilePart=0x0) returned 0x2f
[0153.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.762] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\d-xnpctgc1q9.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.764] GetFileType (hFile=0x350) returned 0x1
[0153.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.764] GetFileType (hFile=0x350) returned 0x1
[0153.764] WriteFile (in: hFile=0x350, lpBuffer=0x2236a30*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2236a30*, lpNumberOfBytesWritten=0x19eea0*=0x3a30, lpOverlapped=0x0) returned 1
[0153.765] CloseHandle (hObject=0x350) returned 1
[0153.767] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png", lpFilePart=0x0) returned 0x2f
[0153.767] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png.coom", lpFilePart=0x0) returned 0x34
[0153.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\d-xnpctgc1q9.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fa0300, ftCreationTime.dwHighDateTime=0x1d82618, ftLastAccessTime.dwLowDateTime=0xcd9fa800, ftLastAccessTime.dwHighDateTime=0x1d82973, ftLastWriteTime.dwLowDateTime=0x207fbc37, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x3a30)) returned 1
[0153.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.767] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\d-xnpctgc1q9.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\d-XNPCTgc1Q9.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\d-xnpctgc1q9.png.coom")) returned 1
[0153.768] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", lpFilePart=0x0) returned 0x2a
[0153.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.768] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gsikafh.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.768] GetFileType (hFile=0x350) returned 0x1
[0153.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.768] GetFileType (hFile=0x350) returned 0x1
[0153.768] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x107e2
[0153.769] ReadFile (in: hFile=0x350, lpBuffer=0x223a7ec, nNumberOfBytesToRead=0x107e2, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x223a7ec*, lpNumberOfBytesRead=0x19eeb0*=0x107e2, lpOverlapped=0x0) returned 1
[0153.770] CloseHandle (hObject=0x350) returned 1
[0153.802] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", lpFilePart=0x0) returned 0x2a
[0153.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.802] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gsikafh.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.805] GetFileType (hFile=0x350) returned 0x1
[0153.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.805] GetFileType (hFile=0x350) returned 0x1
[0153.805] WriteFile (in: hFile=0x350, lpBuffer=0x22b8ef0*, nNumberOfBytesToWrite=0x107f0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22b8ef0*, lpNumberOfBytesWritten=0x19eea0*=0x107f0, lpOverlapped=0x0) returned 1
[0153.809] CloseHandle (hObject=0x350) returned 1
[0153.813] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp", lpFilePart=0x0) returned 0x2a
[0153.813] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp.coom", lpFilePart=0x0) returned 0x2f
[0153.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.813] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gsikafh.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f6f0a0, ftCreationTime.dwHighDateTime=0x1d8227b, ftLastAccessTime.dwLowDateTime=0x17e3bb80, ftLastAccessTime.dwHighDateTime=0x1d828b2, ftLastWriteTime.dwLowDateTime=0x2086b12a, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x107f0)) returned 1
[0153.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.813] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gsikafh.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gSIkAFh.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gsikafh.bmp.coom")) returned 1
[0153.815] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", lpFilePart=0x0) returned 0x2f
[0153.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.816] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gxgbf6roc6lb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.816] GetFileType (hFile=0x350) returned 0x1
[0153.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.816] GetFileType (hFile=0x350) returned 0x1
[0153.816] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x17783
[0153.816] ReadFile (in: hFile=0x350, lpBuffer=0x345dd60, nNumberOfBytesToRead=0x17783, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x345dd60*, lpNumberOfBytesRead=0x19eeb0*=0x17783, lpOverlapped=0x0) returned 1
[0153.818] CloseHandle (hObject=0x350) returned 1
[0153.861] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", lpFilePart=0x0) returned 0x2f
[0153.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.861] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gxgbf6roc6lb.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.867] GetFileType (hFile=0x350) returned 0x1
[0153.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.867] GetFileType (hFile=0x350) returned 0x1
[0153.867] WriteFile (in: hFile=0x350, lpBuffer=0x351ef60*, nNumberOfBytesToWrite=0x17790, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x351ef60*, lpNumberOfBytesWritten=0x19eea0*=0x17790, lpOverlapped=0x0) returned 1
[0153.870] CloseHandle (hObject=0x350) returned 1
[0153.874] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg", lpFilePart=0x0) returned 0x2f
[0153.874] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg.coom", lpFilePart=0x0) returned 0x34
[0153.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.875] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gxgbf6roc6lb.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b7400, ftCreationTime.dwHighDateTime=0x1d81d2b, ftLastAccessTime.dwLowDateTime=0xdec8e540, ftLastAccessTime.dwHighDateTime=0x1d82867, ftLastWriteTime.dwLowDateTime=0x2090264f, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x17790)) returned 1
[0153.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.875] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gxgbf6roc6lb.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\gXgbf6roC6Lb.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\gxgbf6roc6lb.jpg.coom")) returned 1
[0153.876] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", lpFilePart=0x0) returned 0x2b
[0153.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.876] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\hlxiniph.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.876] GetFileType (hFile=0x350) returned 0x1
[0153.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.877] GetFileType (hFile=0x350) returned 0x1
[0153.877] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x1391a
[0153.877] ReadFile (in: hFile=0x350, lpBuffer=0x2316b50, nNumberOfBytesToRead=0x1391a, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2316b50*, lpNumberOfBytesRead=0x19eeb0*=0x1391a, lpOverlapped=0x0) returned 1
[0153.879] CloseHandle (hObject=0x350) returned 1
[0153.932] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", lpFilePart=0x0) returned 0x2b
[0153.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.932] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\hlxiniph.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.934] GetFileType (hFile=0x350) returned 0x1
[0153.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0153.934] GetFileType (hFile=0x350) returned 0x1
[0153.934] WriteFile (in: hFile=0x350, lpBuffer=0x21ed974*, nNumberOfBytesToWrite=0x13920, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x21ed974*, lpNumberOfBytesWritten=0x19eea0*=0x13920, lpOverlapped=0x0) returned 1
[0153.937] CloseHandle (hObject=0x350) returned 1
[0153.940] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp", lpFilePart=0x0) returned 0x2b
[0153.940] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp.coom", lpFilePart=0x0) returned 0x30
[0153.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0153.940] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\hlxiniph.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7daed200, ftCreationTime.dwHighDateTime=0x1d827e6, ftLastAccessTime.dwLowDateTime=0xe2a8d900, ftLastAccessTime.dwHighDateTime=0x1d8282f, ftLastWriteTime.dwLowDateTime=0x209a34dc, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13920)) returned 1
[0153.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0153.941] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\hlxiniph.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\hlxInIph.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\hlxiniph.bmp.coom")) returned 1
[0153.941] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", lpFilePart=0x0) returned 0x2d
[0153.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0153.941] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i6fm_t84se.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0153.943] GetFileType (hFile=0x350) returned 0x1
[0153.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0153.943] GetFileType (hFile=0x350) returned 0x1
[0153.943] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x9c9e
[0153.943] ReadFile (in: hFile=0x350, lpBuffer=0x22015d4, nNumberOfBytesToRead=0x9c9e, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22015d4*, lpNumberOfBytesRead=0x19eeb0*=0x9c9e, lpOverlapped=0x0) returned 1
[0153.944] CloseHandle (hObject=0x350) returned 1
[0153.998] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", lpFilePart=0x0) returned 0x2d
[0153.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0153.999] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i6fm_t84se.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.001] GetFileType (hFile=0x350) returned 0x1
[0154.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0154.001] GetFileType (hFile=0x350) returned 0x1
[0154.001] WriteFile (in: hFile=0x350, lpBuffer=0x227f414*, nNumberOfBytesToWrite=0x9ca0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x227f414*, lpNumberOfBytesWritten=0x19eea0*=0x9ca0, lpOverlapped=0x0) returned 1
[0154.003] CloseHandle (hObject=0x350) returned 1
[0154.006] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png", lpFilePart=0x0) returned 0x2d
[0154.006] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png.coom", lpFilePart=0x0) returned 0x32
[0154.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0154.006] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i6fm_t84se.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dce0530, ftCreationTime.dwHighDateTime=0x1d826a6, ftLastAccessTime.dwLowDateTime=0x646692d0, ftLastAccessTime.dwHighDateTime=0x1d8289d, ftLastWriteTime.dwLowDateTime=0x20a42a38, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x9ca0)) returned 1
[0154.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0154.006] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i6fm_t84se.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\I6Fm_t84SE.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\i6fm_t84se.png.coom")) returned 1
[0154.007] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", lpFilePart=0x0) returned 0x30
[0154.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0154.007] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ivsui27svr1y3.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.007] GetFileType (hFile=0x350) returned 0x1
[0154.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0154.008] GetFileType (hFile=0x350) returned 0x1
[0154.008] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x16d5c
[0154.009] ReadFile (in: hFile=0x350, lpBuffer=0x3209090, nNumberOfBytesToRead=0x16d5c, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x3209090*, lpNumberOfBytesRead=0x19eeb0*=0x16d5c, lpOverlapped=0x0) returned 1
[0154.012] CloseHandle (hObject=0x350) returned 1
[0154.046] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", lpFilePart=0x0) returned 0x30
[0154.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0154.046] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ivsui27svr1y3.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.048] GetFileType (hFile=0x350) returned 0x1
[0154.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0154.048] GetFileType (hFile=0x350) returned 0x1
[0154.048] WriteFile (in: hFile=0x350, lpBuffer=0x327b3a8*, nNumberOfBytesToWrite=0x16d60, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x327b3a8*, lpNumberOfBytesWritten=0x19eea0*=0x16d60, lpOverlapped=0x0) returned 1
[0154.051] CloseHandle (hObject=0x350) returned 1
[0154.055] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg", lpFilePart=0x0) returned 0x30
[0154.055] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg.coom", lpFilePart=0x0) returned 0x35
[0154.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0154.056] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ivsui27svr1y3.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde0b0ec0, ftCreationTime.dwHighDateTime=0x1d8258e, ftLastAccessTime.dwLowDateTime=0x2e000b40, ftLastAccessTime.dwHighDateTime=0x1d82910, ftLastWriteTime.dwLowDateTime=0x20abc362, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x16d60)) returned 1
[0154.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0154.056] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ivsui27svr1y3.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ivsui27SVr1Y3.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\ivsui27svr1y3.jpg.coom")) returned 1
[0154.057] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", lpFilePart=0x0) returned 0x34
[0154.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0154.057] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lsoqhqon27oebzqi8.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.057] GetFileType (hFile=0x350) returned 0x1
[0154.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0154.057] GetFileType (hFile=0x350) returned 0x1
[0154.057] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x13230
[0154.058] ReadFile (in: hFile=0x350, lpBuffer=0x22d6598, nNumberOfBytesToRead=0x13230, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x22d6598*, lpNumberOfBytesRead=0x19eeb0*=0x13230, lpOverlapped=0x0) returned 1
[0154.060] CloseHandle (hObject=0x350) returned 1
[0154.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", lpFilePart=0x0) returned 0x34
[0154.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0154.147] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lsoqhqon27oebzqi8.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.148] GetFileType (hFile=0x350) returned 0x1
[0154.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0154.149] GetFileType (hFile=0x350) returned 0x1
[0154.149] WriteFile (in: hFile=0x350, lpBuffer=0x235ca2c*, nNumberOfBytesToWrite=0x13240, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x235ca2c*, lpNumberOfBytesWritten=0x19eea0*=0x13240, lpOverlapped=0x0) returned 1
[0154.151] CloseHandle (hObject=0x350) returned 1
[0154.155] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg", lpFilePart=0x0) returned 0x34
[0154.155] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg.coom", lpFilePart=0x0) returned 0x39
[0154.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0154.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lsoqhqon27oebzqi8.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16116470, ftCreationTime.dwHighDateTime=0x1d8200a, ftLastAccessTime.dwLowDateTime=0x96f1bb50, ftLastAccessTime.dwHighDateTime=0x1d825c1, ftLastWriteTime.dwLowDateTime=0x20bae72e, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13240)) returned 1
[0154.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0154.157] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lsoqhqon27oebzqi8.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\lsOQhqoN27oebZQi8.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\lsoqhqon27oebzqi8.jpg.coom")) returned 1
[0154.158] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", lpFilePart=0x0) returned 0x2c
[0154.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0154.158] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mi45qg6wk.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.159] GetFileType (hFile=0x350) returned 0x1
[0154.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0154.159] GetFileType (hFile=0x350) returned 0x1
[0154.159] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x12837
[0154.159] ReadFile (in: hFile=0x350, lpBuffer=0x2370018, nNumberOfBytesToRead=0x12837, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2370018*, lpNumberOfBytesRead=0x19eeb0*=0x12837, lpOverlapped=0x0) returned 1
[0154.161] CloseHandle (hObject=0x350) returned 1
[0154.307] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", lpFilePart=0x0) returned 0x2c
[0154.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0154.307] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mi45qg6wk.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.309] GetFileType (hFile=0x350) returned 0x1
[0154.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0154.309] GetFileType (hFile=0x350) returned 0x1
[0154.309] WriteFile (in: hFile=0x350, lpBuffer=0x21edaf0*, nNumberOfBytesToWrite=0x12840, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x21edaf0*, lpNumberOfBytesWritten=0x19eea0*=0x12840, lpOverlapped=0x0) returned 1
[0154.311] CloseHandle (hObject=0x350) returned 1
[0154.315] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp", lpFilePart=0x0) returned 0x2c
[0154.315] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp.coom", lpFilePart=0x0) returned 0x31
[0154.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0154.315] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mi45qg6wk.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb95b0, ftCreationTime.dwHighDateTime=0x1d821be, ftLastAccessTime.dwLowDateTime=0x866ed1f0, ftLastAccessTime.dwHighDateTime=0x1d82274, ftLastWriteTime.dwLowDateTime=0x20d361b0, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x12840)) returned 1
[0154.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0154.315] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mi45qg6wk.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mi45QG6WK.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mi45qg6wk.bmp.coom")) returned 1
[0154.317] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", lpFilePart=0x0) returned 0x2e
[0154.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0154.317] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mjal9vxiet_.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.317] GetFileType (hFile=0x350) returned 0x1
[0154.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0154.317] GetFileType (hFile=0x350) returned 0x1
[0154.317] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x131f2
[0154.317] ReadFile (in: hFile=0x350, lpBuffer=0x220067c, nNumberOfBytesToRead=0x131f2, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x220067c*, lpNumberOfBytesRead=0x19eeb0*=0x131f2, lpOverlapped=0x0) returned 1
[0154.319] CloseHandle (hObject=0x350) returned 1
[0154.447] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", lpFilePart=0x0) returned 0x2e
[0154.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0154.448] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mjal9vxiet_.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.450] GetFileType (hFile=0x350) returned 0x1
[0154.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0154.450] GetFileType (hFile=0x350) returned 0x1
[0154.450] WriteFile (in: hFile=0x350, lpBuffer=0x2286bb0*, nNumberOfBytesToWrite=0x13200, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2286bb0*, lpNumberOfBytesWritten=0x19eea0*=0x13200, lpOverlapped=0x0) returned 1
[0154.455] CloseHandle (hObject=0x350) returned 1
[0154.461] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg", lpFilePart=0x0) returned 0x2e
[0154.461] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg.coom", lpFilePart=0x0) returned 0x33
[0154.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0154.461] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mjal9vxiet_.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17995170, ftCreationTime.dwHighDateTime=0x1d81df0, ftLastAccessTime.dwLowDateTime=0x310f83c0, ftLastAccessTime.dwHighDateTime=0x1d81e10, ftLastWriteTime.dwLowDateTime=0x20e9a564, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x13200)) returned 1
[0154.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0154.462] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mjal9vxiet_.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\mJaL9VXieT_.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\mjal9vxiet_.jpg.coom")) returned 1
[0154.463] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", lpFilePart=0x0) returned 0x29
[0154.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0154.463] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nlit5d.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.463] GetFileType (hFile=0x350) returned 0x1
[0154.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0154.463] GetFileType (hFile=0x350) returned 0x1
[0154.463] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xc88d
[0154.464] ReadFile (in: hFile=0x350, lpBuffer=0x229a114, nNumberOfBytesToRead=0xc88d, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x229a114*, lpNumberOfBytesRead=0x19eeb0*=0xc88d, lpOverlapped=0x0) returned 1
[0154.466] CloseHandle (hObject=0x350) returned 1
[0154.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", lpFilePart=0x0) returned 0x29
[0154.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0154.505] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nlit5d.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.507] GetFileType (hFile=0x350) returned 0x1
[0154.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0154.507] GetFileType (hFile=0x350) returned 0x1
[0154.507] WriteFile (in: hFile=0x350, lpBuffer=0x230c89c*, nNumberOfBytesToWrite=0xc890, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x230c89c*, lpNumberOfBytesWritten=0x19eea0*=0xc890, lpOverlapped=0x0) returned 1
[0154.512] CloseHandle (hObject=0x350) returned 1
[0154.516] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp", lpFilePart=0x0) returned 0x29
[0154.516] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp.coom", lpFilePart=0x0) returned 0x2e
[0154.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0154.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nlit5d.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf90a3270, ftCreationTime.dwHighDateTime=0x1d81d94, ftLastAccessTime.dwLowDateTime=0xdbb79470, ftLastAccessTime.dwHighDateTime=0x1d81f91, ftLastWriteTime.dwLowDateTime=0x20f20767, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xc890)) returned 1
[0154.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0154.517] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nlit5d.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\NLit5D.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\nlit5d.bmp.coom")) returned 1
[0154.517] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", lpFilePart=0x0) returned 0x32
[0154.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0154.518] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\prgqydqfetzpsuf.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.518] GetFileType (hFile=0x350) returned 0x1
[0154.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0154.518] GetFileType (hFile=0x350) returned 0x1
[0154.518] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x2400
[0154.518] ReadFile (in: hFile=0x350, lpBuffer=0x231946c, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x231946c*, lpNumberOfBytesRead=0x19eeb0*=0x2400, lpOverlapped=0x0) returned 1
[0154.519] CloseHandle (hObject=0x350) returned 1
[0154.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", lpFilePart=0x0) returned 0x32
[0154.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0154.726] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\prgqydqfetzpsuf.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.728] GetFileType (hFile=0x350) returned 0x1
[0154.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0154.728] GetFileType (hFile=0x350) returned 0x1
[0154.728] WriteFile (in: hFile=0x350, lpBuffer=0x237167c*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x237167c*, lpNumberOfBytesWritten=0x19eea0*=0x2410, lpOverlapped=0x0) returned 1
[0154.729] CloseHandle (hObject=0x350) returned 1
[0154.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp", lpFilePart=0x0) returned 0x32
[0154.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp.coom", lpFilePart=0x0) returned 0x37
[0154.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0154.731] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\prgqydqfetzpsuf.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4844e550, ftCreationTime.dwHighDateTime=0x1d81ae4, ftLastAccessTime.dwLowDateTime=0xe15bdb00, ftLastAccessTime.dwHighDateTime=0x1d81f39, ftLastWriteTime.dwLowDateTime=0x2112d0ce, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x2410)) returned 1
[0154.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0154.731] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\prgqydqfetzpsuf.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\prgQYDqfEtZPsUF.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\prgqydqfetzpsuf.bmp.coom")) returned 1
[0154.732] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", lpFilePart=0x0) returned 0x27
[0154.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0154.732] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\srpt.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.732] GetFileType (hFile=0x350) returned 0x1
[0154.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0154.732] GetFileType (hFile=0x350) returned 0x1
[0154.732] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x6992
[0154.732] ReadFile (in: hFile=0x350, lpBuffer=0x2373df8, nNumberOfBytesToRead=0x6992, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2373df8*, lpNumberOfBytesRead=0x19eeb0*=0x6992, lpOverlapped=0x0) returned 1
[0154.734] CloseHandle (hObject=0x350) returned 1
[0154.833] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", lpFilePart=0x0) returned 0x27
[0154.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0154.833] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\srpt.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.834] GetFileType (hFile=0x350) returned 0x1
[0154.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0154.835] GetFileType (hFile=0x350) returned 0x1
[0154.835] WriteFile (in: hFile=0x350, lpBuffer=0x23e1bdc*, nNumberOfBytesToWrite=0x69a0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x23e1bdc*, lpNumberOfBytesWritten=0x19eea0*=0x69a0, lpOverlapped=0x0) returned 1
[0154.836] CloseHandle (hObject=0x350) returned 1
[0154.839] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp", lpFilePart=0x0) returned 0x27
[0154.839] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp.coom", lpFilePart=0x0) returned 0x2c
[0154.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0154.839] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\srpt.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1906ebb0, ftCreationTime.dwHighDateTime=0x1d82676, ftLastAccessTime.dwLowDateTime=0xa2a90710, ftLastAccessTime.dwHighDateTime=0x1d829b7, ftLastWriteTime.dwLowDateTime=0x21233906, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x69a0)) returned 1
[0154.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0154.839] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\srpt.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\srPT.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\srpt.bmp.coom")) returned 1
[0154.840] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", lpFilePart=0x0) returned 0x2c
[0154.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0154.841] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sszyckq2_.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.841] GetFileType (hFile=0x350) returned 0x1
[0154.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0154.841] GetFileType (hFile=0x350) returned 0x1
[0154.841] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x6ebb
[0154.841] ReadFile (in: hFile=0x350, lpBuffer=0x23e8890, nNumberOfBytesToRead=0x6ebb, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23e8890*, lpNumberOfBytesRead=0x19eeb0*=0x6ebb, lpOverlapped=0x0) returned 1
[0154.843] CloseHandle (hObject=0x350) returned 1
[0154.907] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", lpFilePart=0x0) returned 0x2c
[0154.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0154.907] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sszyckq2_.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.909] GetFileType (hFile=0x350) returned 0x1
[0154.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0154.909] GetFileType (hFile=0x350) returned 0x1
[0154.909] WriteFile (in: hFile=0x350, lpBuffer=0x225be5c*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x225be5c*, lpNumberOfBytesWritten=0x19eea0*=0x6ec0, lpOverlapped=0x0) returned 1
[0154.910] CloseHandle (hObject=0x350) returned 1
[0154.912] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png", lpFilePart=0x0) returned 0x2c
[0154.913] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png.coom", lpFilePart=0x0) returned 0x31
[0154.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0154.913] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sszyckq2_.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ae76680, ftCreationTime.dwHighDateTime=0x1d827e5, ftLastAccessTime.dwLowDateTime=0xfb7a2390, ftLastAccessTime.dwHighDateTime=0x1d82a22, ftLastWriteTime.dwLowDateTime=0x212e8b05, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x6ec0)) returned 1
[0154.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0154.920] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sszyckq2_.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ssZyCkQ2_.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sszyckq2_.png.coom")) returned 1
[0154.921] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", lpFilePart=0x0) returned 0x31
[0154.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0154.921] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sy8zc6o0w2dpzb.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.922] GetFileType (hFile=0x350) returned 0x1
[0154.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0154.922] GetFileType (hFile=0x350) returned 0x1
[0154.922] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x40be
[0154.922] ReadFile (in: hFile=0x350, lpBuffer=0x2263074, nNumberOfBytesToRead=0x40be, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2263074*, lpNumberOfBytesRead=0x19eeb0*=0x40be, lpOverlapped=0x0) returned 1
[0154.925] CloseHandle (hObject=0x350) returned 1
[0154.953] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", lpFilePart=0x0) returned 0x31
[0154.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0154.953] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sy8zc6o0w2dpzb.jpg"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.958] GetFileType (hFile=0x350) returned 0x1
[0154.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0154.958] GetFileType (hFile=0x350) returned 0x1
[0154.958] WriteFile (in: hFile=0x350, lpBuffer=0x22c4354*, nNumberOfBytesToWrite=0x40c0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22c4354*, lpNumberOfBytesWritten=0x19eea0*=0x40c0, lpOverlapped=0x0) returned 1
[0154.960] CloseHandle (hObject=0x350) returned 1
[0154.962] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg", lpFilePart=0x0) returned 0x31
[0154.962] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg.coom", lpFilePart=0x0) returned 0x36
[0154.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0154.962] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sy8zc6o0w2dpzb.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5cf6670, ftCreationTime.dwHighDateTime=0x1d81baa, ftLastAccessTime.dwLowDateTime=0x4a155b70, ftLastAccessTime.dwHighDateTime=0x1d823eb, ftLastWriteTime.dwLowDateTime=0x21361855, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x40c0)) returned 1
[0154.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0154.962] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sy8zc6o0w2dpzb.jpg"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\sy8Zc6o0W2Dpzb.jpg.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\sy8zc6o0w2dpzb.jpg.coom")) returned 1
[0154.967] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", lpFilePart=0x0) returned 0x36
[0154.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0154.967] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\thhlqm_vxfrhakjgqh4.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0154.968] GetFileType (hFile=0x350) returned 0x1
[0154.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0154.968] GetFileType (hFile=0x350) returned 0x1
[0154.968] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x14dce
[0154.969] ReadFile (in: hFile=0x350, lpBuffer=0x331cb48, nNumberOfBytesToRead=0x14dce, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x331cb48*, lpNumberOfBytesRead=0x19eeb0*=0x14dce, lpOverlapped=0x0) returned 1
[0154.972] CloseHandle (hObject=0x350) returned 1
[0155.013] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", lpFilePart=0x0) returned 0x36
[0155.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0155.013] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\thhlqm_vxfrhakjgqh4.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0155.015] GetFileType (hFile=0x350) returned 0x1
[0155.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0155.015] GetFileType (hFile=0x350) returned 0x1
[0155.016] WriteFile (in: hFile=0x350, lpBuffer=0x3385098*, nNumberOfBytesToWrite=0x14dd0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x3385098*, lpNumberOfBytesWritten=0x19eea0*=0x14dd0, lpOverlapped=0x0) returned 1
[0155.019] CloseHandle (hObject=0x350) returned 1
[0155.023] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp", lpFilePart=0x0) returned 0x36
[0155.023] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp.coom", lpFilePart=0x0) returned 0x3b
[0155.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0155.023] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\thhlqm_vxfrhakjgqh4.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea8680, ftCreationTime.dwHighDateTime=0x1d81c3d, ftLastAccessTime.dwLowDateTime=0x53695f10, ftLastAccessTime.dwHighDateTime=0x1d8228c, ftLastWriteTime.dwLowDateTime=0x213f62d8, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x14dd0)) returned 1
[0155.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0155.023] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\thhlqm_vxfrhakjgqh4.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\thhlqm_vXfrhAkJgqh4.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\thhlqm_vxfrhakjgqh4.bmp.coom")) returned 1
[0155.024] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", lpFilePart=0x0) returned 0x34
[0155.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0155.025] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\tq-yo c2w6tz7vngz.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0155.025] GetFileType (hFile=0x350) returned 0x1
[0155.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0155.028] GetFileType (hFile=0x350) returned 0x1
[0155.028] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xc6cc
[0155.028] ReadFile (in: hFile=0x350, lpBuffer=0x2315944, nNumberOfBytesToRead=0xc6cc, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2315944*, lpNumberOfBytesRead=0x19eeb0*=0xc6cc, lpOverlapped=0x0) returned 1
[0155.030] CloseHandle (hObject=0x350) returned 1
[0155.060] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", lpFilePart=0x0) returned 0x34
[0155.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0155.060] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\tq-yo c2w6tz7vngz.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0155.062] GetFileType (hFile=0x350) returned 0x1
[0155.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0155.063] GetFileType (hFile=0x350) returned 0x1
[0155.063] WriteFile (in: hFile=0x350, lpBuffer=0x2387b88*, nNumberOfBytesToWrite=0xc6d0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2387b88*, lpNumberOfBytesWritten=0x19eea0*=0xc6d0, lpOverlapped=0x0) returned 1
[0155.068] CloseHandle (hObject=0x350) returned 1
[0155.071] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp", lpFilePart=0x0) returned 0x34
[0155.071] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp.coom", lpFilePart=0x0) returned 0x39
[0155.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0155.071] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\tq-yo c2w6tz7vngz.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dd84b0, ftCreationTime.dwHighDateTime=0x1d81f2c, ftLastAccessTime.dwLowDateTime=0xb3842800, ftLastAccessTime.dwHighDateTime=0x1d8228f, ftLastWriteTime.dwLowDateTime=0x2146b5dc, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xc6d0)) returned 1
[0155.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0155.071] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\tq-yo c2w6tz7vngz.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Tq-YO c2w6Tz7VNGz.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\tq-yo c2w6tz7vngz.bmp.coom")) returned 1
[0155.072] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", lpFilePart=0x0) returned 0x32
[0155.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0155.072] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\vmb og1vu5v_pxk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0155.072] GetFileType (hFile=0x350) returned 0x1
[0155.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0155.073] GetFileType (hFile=0x350) returned 0x1
[0155.073] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0xd60
[0155.073] ReadFile (in: hFile=0x350, lpBuffer=0x2395370, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2395370*, lpNumberOfBytesRead=0x19eeb0*=0xd60, lpOverlapped=0x0) returned 1
[0155.074] CloseHandle (hObject=0x350) returned 1
[0155.225] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", lpFilePart=0x0) returned 0x32
[0155.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0155.225] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\vmb og1vu5v_pxk.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0155.227] GetFileType (hFile=0x350) returned 0x1
[0155.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0155.227] GetFileType (hFile=0x350) returned 0x1
[0155.227] WriteFile (in: hFile=0x350, lpBuffer=0x23e7580*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x19ee74, lpOverlapped=0x0 | out: lpBuffer=0x23e7580*, lpNumberOfBytesWritten=0x19ee74*=0xd70, lpOverlapped=0x0) returned 1
[0155.229] CloseHandle (hObject=0x350) returned 1
[0155.230] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png", lpFilePart=0x0) returned 0x32
[0155.230] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png.coom", lpFilePart=0x0) returned 0x37
[0155.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0155.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\vmb og1vu5v_pxk.png"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa9b3c0, ftCreationTime.dwHighDateTime=0x1d81d89, ftLastAccessTime.dwLowDateTime=0x66c4d260, ftLastAccessTime.dwHighDateTime=0x1d822f0, ftLastWriteTime.dwLowDateTime=0x215f0cc3, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0xd70)) returned 1
[0155.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0155.231] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\vmb og1vu5v_pxk.png"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Vmb OG1vu5V_PXk.png.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\vmb og1vu5v_pxk.png.coom")) returned 1
[0155.232] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", lpFilePart=0x0) returned 0x32
[0155.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0155.232] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\zfatyxdgq7tzjo4.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0155.232] GetFileType (hFile=0x350) returned 0x1
[0155.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0155.232] GetFileType (hFile=0x350) returned 0x1
[0155.232] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x28b2
[0155.232] ReadFile (in: hFile=0x350, lpBuffer=0x23e885c, nNumberOfBytesToRead=0x28b2, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x23e885c*, lpNumberOfBytesRead=0x19eeb0*=0x28b2, lpOverlapped=0x0) returned 1
[0155.234] CloseHandle (hObject=0x350) returned 1
[0155.322] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", lpFilePart=0x0) returned 0x32
[0155.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0155.323] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\zfatyxdgq7tzjo4.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0155.325] GetFileType (hFile=0x350) returned 0x1
[0155.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0155.325] GetFileType (hFile=0x350) returned 0x1
[0155.325] WriteFile (in: hFile=0x350, lpBuffer=0x2252c34*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x2252c34*, lpNumberOfBytesWritten=0x19eea0*=0x28c0, lpOverlapped=0x0) returned 1
[0155.326] CloseHandle (hObject=0x350) returned 1
[0155.328] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp", lpFilePart=0x0) returned 0x32
[0155.328] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp.coom", lpFilePart=0x0) returned 0x37
[0155.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0155.328] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\zfatyxdgq7tzjo4.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3ae720, ftCreationTime.dwHighDateTime=0x1d820f5, ftLastAccessTime.dwLowDateTime=0x88ac5290, ftLastAccessTime.dwHighDateTime=0x1d8298a, ftLastWriteTime.dwLowDateTime=0x216deeb5, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x28c0)) returned 1
[0155.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0155.328] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\zfatyxdgq7tzjo4.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\ZfAtYXdgQ7TzJo4.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\zfatyxdgq7tzjo4.bmp.coom")) returned 1
[0155.329] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", nBufferLength=0x105, lpBuffer=0x19e908, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", lpFilePart=0x0) returned 0x2c
[0155.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19edfc) returned 1
[0155.329] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_lbbor qp.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0155.329] GetFileType (hFile=0x350) returned 0x1
[0155.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19edf8) returned 1
[0155.330] GetFileType (hFile=0x350) returned 0x1
[0155.330] GetFileSize (in: hFile=0x350, lpFileSizeHigh=0x19ef04 | out: lpFileSizeHigh=0x19ef04*=0x0) returned 0x6c49
[0155.330] ReadFile (in: hFile=0x350, lpBuffer=0x2255874, nNumberOfBytesToRead=0x6c49, lpNumberOfBytesRead=0x19eeb0, lpOverlapped=0x0 | out: lpBuffer=0x2255874*, lpNumberOfBytesRead=0x19eeb0*=0x6c49, lpOverlapped=0x0) returned 1
[0155.331] CloseHandle (hObject=0x350) returned 1
[0155.371] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", nBufferLength=0x105, lpBuffer=0x19e8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", lpFilePart=0x0) returned 0x2c
[0155.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ede4) returned 1
[0155.371] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_lbbor qp.bmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x350
[0155.373] GetFileType (hFile=0x350) returned 0x1
[0155.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ede0) returned 1
[0155.373] GetFileType (hFile=0x350) returned 0x1
[0155.373] WriteFile (in: hFile=0x350, lpBuffer=0x22c4524*, nNumberOfBytesToWrite=0x6c50, lpNumberOfBytesWritten=0x19eea0, lpOverlapped=0x0 | out: lpBuffer=0x22c4524*, lpNumberOfBytesWritten=0x19eea0*=0x6c50, lpOverlapped=0x0) returned 1
[0155.376] CloseHandle (hObject=0x350) returned 1
[0155.378] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp", lpFilePart=0x0) returned 0x2c
[0155.378] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp.coom", nBufferLength=0x105, lpBuffer=0x19ea28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp.coom", lpFilePart=0x0) returned 0x31
[0155.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee88) returned 1
[0155.379] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_lbbor qp.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19ef04 | out: lpFileInformation=0x19ef04*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df1b940, ftCreationTime.dwHighDateTime=0x1d819db, ftLastAccessTime.dwLowDateTime=0x2ff12ab0, ftLastAccessTime.dwHighDateTime=0x1d81ccc, ftLastWriteTime.dwLowDateTime=0x2175a2b9, ftLastWriteTime.dwHighDateTime=0x1d858a0, nFileSizeHigh=0x0, nFileSizeLow=0x6c50)) returned 1
[0155.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee84) returned 1
[0155.379] MoveFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_lbbor qp.bmp"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\_LbBOR Qp.bmp.coom" (normalized: "c:\\users\\rdhj0cnfevzx\\pictures\\_lbbor qp.bmp.coom")) returned 1
[0155.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0155.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a
[0155.382] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", lpFilePart=0x0) returned 0x2b
[0155.382] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6904e0
[0155.383] FindNextFileW (in: hFindFile=0x6904e0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0155.384] FindNextFileW (in: hFindFile=0x6904e0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0155.384] FindNextFileW (in: hFindFile=0x6904e0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0155.384] FindClose (in: hFindFile=0x6904e0 | out: hFindFile=0x6904e0) returned 1
[0155.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1
[0155.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1
[0155.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0155.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll", lpFilePart=0x0) returned 0x2a
[0155.385] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\", lpFilePart=0x0) returned 0x2b
[0155.385] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Camera Roll\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x690920
[0155.385] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b0e752d, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0155.386] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0155.386] FindNextFileW (in: hFindFile=0x690920, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b10dbc5, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b10dbc5, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b10dbc5, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
[0155.386] FindClose (in: hFindFile=0x690920 | out: hFindFile=0x690920) returned 1
[0155.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1
[0155.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1
[0155.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0155.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x2d
[0155.387] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", lpFilePart=0x0) returned 0x2e
[0155.387] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6908a0
[0155.388] FindNextFileW (in: hFindFile=0x6908a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0155.388] FindNextFileW (in: hFindFile=0x6908a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0155.389] FindNextFileW (in: hFindFile=0x6908a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0
[0155.389] FindClose (in: hFindFile=0x6908a0 | out: hFindFile=0x6908a0) returned 1
[0155.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1
[0155.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1
[0155.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eec8) returned 1
[0155.389] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", nBufferLength=0x105, lpBuffer=0x19e9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures", lpFilePart=0x0) returned 0x2d
[0155.389] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\", lpFilePart=0x0) returned 0x2e
[0155.389] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Pictures\\Saved Pictures\\*", lpFindFileData=0x19ebf0 | out: lpFindFileData=0x19ebf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6909a0
[0155.389] FindNextFileW (in: hFindFile=0x6909a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
[0155.390] FindNextFileW (in: hFindFile=0x6909a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
[0155.390] FindNextFileW (in: hFindFile=0x6909a0, lpFindFileData=0x19ec00 | out: lpFindFileData=0x19ec00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x2b1a6533, ftCreationTime.dwHighDateTime=0x1d70504, ftLastAccessTime.dwLowDateTime=0x2b1a6533, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1a6533, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
[0155.390] FindClose (in: hFindFile=0x6909a0 | out: hFindFile=0x6909a0) returned 1
[0155.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee88) returned 1
[0155.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee94) returned 1
[0155.425] GetACP () returned 0x4e4
[0155.800] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19e828, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16
[0155.800] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", nBufferLength=0x105, lpBuffer=0x19e83c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", lpFilePart=0x0) returned 0x3a
[0155.800] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", nBufferLength=0x105, lpBuffer=0x19e7e4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", lpFilePart=0x0) returned 0x3a
[0156.288] GetCurrentProcess () returned 0xffffffff
[0156.288] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb9c | out: TokenHandle=0x19eb9c*=0x34c) returned 1
[0156.294] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19e678, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
[0156.298] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb9c | out: lpFileInformation=0x19eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1
[0156.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e644, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
[0156.300] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb9c | out: lpFileInformation=0x19eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1
[0156.300] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e5d4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
[0156.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19eac8) returned 1
[0156.301] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x348
[0156.301] GetFileType (hFile=0x348) returned 0x1
[0156.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19eac4) returned 1
[0156.301] GetFileType (hFile=0x348) returned 0x1
[0156.343] GetFileSize (in: hFile=0x348, lpFileSizeHigh=0x19eb90 | out: lpFileSizeHigh=0x19eb90*=0x0) returned 0x8c8f
[0156.343] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19eb4c, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19eb4c*=0x1000, lpOverlapped=0x0) returned 1
[0156.364] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e9e8, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e9e8*=0x1000, lpOverlapped=0x0) returned 1
[0156.371] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e89c, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e89c*=0x1000, lpOverlapped=0x0) returned 1
[0156.372] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e89c, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e89c*=0x1000, lpOverlapped=0x0) returned 1
[0156.372] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e89c, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e89c*=0x1000, lpOverlapped=0x0) returned 1
[0156.372] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e7d4, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e7d4*=0x1000, lpOverlapped=0x0) returned 1
[0156.383] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e950, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e950*=0x1000, lpOverlapped=0x0) returned 1
[0156.386] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e864, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e864*=0x1000, lpOverlapped=0x0) returned 1
[0156.386] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e864, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e864*=0xc8f, lpOverlapped=0x0) returned 1
[0156.386] ReadFile (in: hFile=0x348, lpBuffer=0x22d1b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x22d1b70*, lpNumberOfBytesRead=0x19e924*=0x0, lpOverlapped=0x0) returned 1
[0156.387] CloseHandle (hObject=0x348) returned 1
[0156.389] GetCurrentProcess () returned 0xffffffff
[0156.389] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ecc4 | out: TokenHandle=0x19ecc4*=0x348) returned 1
[0156.389] GetCurrentProcess () returned 0xffffffff
[0156.389] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ecc4 | out: TokenHandle=0x19ecc4*=0x354) returned 1
[0156.390] GetCurrentProcess () returned 0xffffffff
[0156.390] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eb9c | out: TokenHandle=0x19eb9c*=0x358) returned 1
[0156.390] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb9c | out: lpFileInformation=0x19eb9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0156.391] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", nBufferLength=0x105, lpBuffer=0x19e644, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config", lpFilePart=0x0) returned 0x3a
[0156.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19eb9c | out: lpFileInformation=0x19eb9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0156.392] GetCurrentProcess () returned 0xffffffff
[0156.392] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ecc4 | out: TokenHandle=0x19ecc4*=0x35c) returned 1
[0156.392] GetCurrentProcess () returned 0xffffffff
[0156.392] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ecc4 | out: TokenHandle=0x19ecc4*=0x360) returned 1
[0156.412] GetCurrentProcess () returned 0xffffffff
[0156.412] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea88 | out: TokenHandle=0x19ea88*=0x364) returned 1
[0156.456] GetCurrentProcess () returned 0xffffffff
[0156.456] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea9c | out: TokenHandle=0x19ea9c*=0x368) returned 1
[0156.497] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x36c
[0156.498] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x370
[0156.500] GetCurrentProcess () returned 0xffffffff
[0156.500] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eaa4 | out: TokenHandle=0x19eaa4*=0x374) returned 1
[0156.505] GetCurrentProcess () returned 0xffffffff
[0156.505] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eab8 | out: TokenHandle=0x19eab8*=0x378) returned 1
[0156.510] QueryPerformanceFrequency (in: lpFrequency=0x4b5a48 | out: lpFrequency=0x4b5a48*=100000000) returned 1
[0156.510] QueryPerformanceCounter (in: lpPerformanceCount=0x19eec0 | out: lpPerformanceCount=0x19eec0*=1693889717896) returned 1
[0156.516] GetCurrentProcess () returned 0xffffffff
[0156.516] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea74 | out: TokenHandle=0x19ea74*=0x37c) returned 1
[0156.521] GetCurrentProcess () returned 0xffffffff
[0156.521] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea88 | out: TokenHandle=0x19ea88*=0x380) returned 1
[0156.538] GetCurrentProcess () returned 0xffffffff
[0156.538] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea88 | out: TokenHandle=0x19ea88*=0x384) returned 1
[0156.541] GetCurrentProcess () returned 0xffffffff
[0156.541] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea9c | out: TokenHandle=0x19ea9c*=0x388) returned 1
[0156.551] GetCurrentProcess () returned 0xffffffff
[0156.551] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19eda8 | out: TokenHandle=0x19eda8*=0x38c) returned 1
[0156.584] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19def4 | out: phkResult=0x19def4*=0x390) returned 0x0
[0156.584] RegQueryValueExW (in: hKey=0x390, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19df14, lpData=0x0, lpcbData=0x19df10*=0x0 | out: lpType=0x19df14*=0x1, lpData=0x0, lpcbData=0x19df10*=0xe) returned 0x0
[0156.584] RegQueryValueExW (in: hKey=0x390, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19df14, lpData=0x22f55ac, lpcbData=0x19df10*=0xe | out: lpType=0x19df14*=0x1, lpData="Client", lpcbData=0x19df10*=0xe) returned 0x0
[0156.585] RegCloseKey (hKey=0x390) returned 0x0
[0157.335] CoTaskMemAlloc (cb=0xcc0) returned 0x6d0408
[0157.335] RasEnumConnectionsW (in: param_1=0x6d0408, param_2=0x19edb8, param_3=0x19edbc | out: param_1=0x6d0408, param_2=0x19edb8, param_3=0x19edbc) returned 0x0
[0157.565] CoTaskMemFree (pv=0x6d0408)
[0158.023] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19eba0 | out: lpWSAData=0x19eba0) returned 0
[0158.038] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3e8
[0158.476] setsockopt (s=0x3e8, level=65535, optname=128, optval="\x01", optlen=4) returned -1
[0158.477] closesocket (s=0x3e8) returned 0
[0158.477] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3e8
[0158.478] setsockopt (s=0x3e8, level=65535, optname=128, optval="\x01", optlen=4) returned -1
[0158.479] closesocket (s=0x3e8) returned 0
[0158.479] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3e8
[0158.480] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3ec
[0158.480] ioctlsocket (in: s=0x3e8, cmd=-2147195266, argp=0x19edc0 | out: argp=0x19edc0) returned 0
[0158.481] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x3f0
[0158.481] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f4
[0158.481] ioctlsocket (in: s=0x3f0, cmd=-2147195266, argp=0x19edc0 | out: argp=0x19edc0) returned 0
[0158.482] WSAIoctl (in: s=0x3e8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19eda8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19eda8, lpOverlapped=0x0) returned -1
[0158.483] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ead8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
[0158.491] WSAEventSelect (s=0x3e8, hEventObject=0x3ec, lNetworkEvents=512) returned 0
[0158.492] WSAIoctl (in: s=0x3f0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19eda8, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19eda8, lpOverlapped=0x0) returned -1
[0158.492] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ead8, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
[0158.492] WSAEventSelect (s=0x3f0, hEventObject=0x3f4, lNetworkEvents=512) returned 0
[0158.492] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3fc
[0158.492] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x3fc, param_3=0x3) returned 0x0
[0158.508] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x19edd4 | out: phkResult=0x19edd4*=0x418) returned 0x0
[0158.508] RegOpenKeyExW (in: hKey=0x418, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed84 | out: phkResult=0x19ed84*=0x41c) returned 0x0
[0158.509] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x420
[0158.509] RegNotifyChangeKeyValue (hKey=0x41c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x420, fAsynchronous=1) returned 0x0
[0158.511] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed88 | out: phkResult=0x19ed88*=0x424) returned 0x0
[0158.511] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x428
[0158.511] RegNotifyChangeKeyValue (hKey=0x424, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x428, fAsynchronous=1) returned 0x0
[0158.512] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ed88 | out: phkResult=0x19ed88*=0x42c) returned 0x0
[0158.512] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x430
[0158.512] RegNotifyChangeKeyValue (hKey=0x42c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x430, fAsynchronous=1) returned 0x0
[0158.513] GetCurrentProcess () returned 0xffffffff
[0158.513] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ed7c | out: TokenHandle=0x19ed7c*=0x434) returned 1
[0158.518] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e688 | out: phkResult=0x19e688*=0x438) returned 0x0
[0158.518] RegQueryValueExW (in: hKey=0x438, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x19e6a4, lpData=0x0, lpcbData=0x19e6a0*=0x0 | out: lpType=0x19e6a4*=0x0, lpData=0x0, lpcbData=0x19e6a0*=0x0) returned 0x2
[0158.518] RegCloseKey (hKey=0x438) returned 0x0
[0158.948] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x6d7000
[0159.373] WinHttpSetTimeouts (hInternet=0x6d7000, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1
[0159.374] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x19ed88 | out: pProxyConfig=0x19ed88) returned 1
[0160.001] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x19e600, nSize=0x80 | out: lpBuffer="") returned 0x0
[0160.001] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x19e600, nSize=0x80 | out: lpBuffer="") returned 0x0
[0160.009] EtwEventRegister (in: ProviderId=0x22f80fc, EnableCallback=0x4920636, CallbackContext=0x0, RegHandle=0x22f80d8 | out: RegHandle=0x22f80d8) returned 0x0
[0160.010] EtwEventSetInformation (RegHandle=0x6cd9b8, InformationClass=0x4d, EventInformation=0x2, InformationLength=0x22f8098) returned 0x0
[0160.015] GetCurrentProcess () returned 0xffffffff
[0160.015] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea50 | out: TokenHandle=0x19ea50*=0x490) returned 1
[0160.019] GetCurrentProcess () returned 0xffffffff
[0160.019] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea64 | out: TokenHandle=0x19ea64*=0x494) returned 1
[0160.035] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ecd4*=0x3fc, lpdwindex=0x19eaf4 | out: lpdwindex=0x19eaf4) returned 0x80010115
[0160.230] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ecb4*=0x3ec, lpdwindex=0x19ead4 | out: lpdwindex=0x19ead4) returned 0x80010115
[0160.231] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ecb4*=0x3f4, lpdwindex=0x19ead4 | out: lpdwindex=0x19ead4) returned 0x80010115
[0160.231] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ed08*=0x420, lpdwindex=0x19eb24 | out: lpdwindex=0x19eb24) returned 0x80010115
[0160.232] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ed08*=0x428, lpdwindex=0x19eb24 | out: lpdwindex=0x19eb24) returned 0x80010115
[0160.233] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19ed08*=0x430, lpdwindex=0x19eb24 | out: lpdwindex=0x19eb24) returned 0x80010115
[0160.240] GetCurrentProcess () returned 0xffffffff
[0160.240] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e9a4 | out: TokenHandle=0x19e9a4*=0x4b4) returned 1
[0160.241] GetCurrentProcess () returned 0xffffffff
[0160.242] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e9b8 | out: TokenHandle=0x19e9b8*=0x4b8) returned 1
[0160.247] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19ebbc | out: lpTimeZoneInformation=0x19ebbc) returned 0x2
[0160.250] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x19ea10 | out: pTimeZoneInformation=0x19ea10) returned 0x2
[0160.252] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eaf4 | out: phkResult=0x19eaf4*=0x4bc) returned 0x0
[0160.252] RegQueryValueExW (in: hKey=0x4bc, lpValueName="TZI", lpReserved=0x0, lpType=0x19eb10, lpData=0x0, lpcbData=0x19eb0c*=0x0 | out: lpType=0x19eb10*=0x3, lpData=0x0, lpcbData=0x19eb0c*=0x2c) returned 0x0
[0160.253] RegQueryValueExW (in: hKey=0x4bc, lpValueName="TZI", lpReserved=0x0, lpType=0x19eb10, lpData=0x22fb198, lpcbData=0x19eb0c*=0x2c | out: lpType=0x19eb10*=0x3, lpData=0x22fb198*, lpcbData=0x19eb0c*=0x2c) returned 0x0
[0160.253] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e948 | out: phkResult=0x19e948*=0x0) returned 0x2
[0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19eae8, lpData=0x0, lpcbData=0x19eae4*=0x0 | out: lpType=0x19eae8*=0x1, lpData=0x0, lpcbData=0x19eae4*=0x20) returned 0x0
[0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19eae8, lpData=0x22fb5bc, lpcbData=0x19eae4*=0x20 | out: lpType=0x19eae8*=0x1, lpData="@tzres.dll,-320", lpcbData=0x19eae4*=0x20) returned 0x0
[0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19eae8, lpData=0x0, lpcbData=0x19eae4*=0x0 | out: lpType=0x19eae8*=0x1, lpData=0x0, lpcbData=0x19eae4*=0x20) returned 0x0
[0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19eae8, lpData=0x22fb614, lpcbData=0x19eae4*=0x20 | out: lpType=0x19eae8*=0x1, lpData="@tzres.dll,-322", lpcbData=0x19eae4*=0x20) returned 0x0
[0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19eae8, lpData=0x0, lpcbData=0x19eae4*=0x0 | out: lpType=0x19eae8*=0x1, lpData=0x0, lpcbData=0x19eae4*=0x20) returned 0x0
[0160.254] RegQueryValueExW (in: hKey=0x4bc, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19eae8, lpData=0x22fb66c, lpcbData=0x19eae4*=0x20 | out: lpType=0x19eae8*=0x1, lpData="@tzres.dll,-321", lpcbData=0x19eae4*=0x20) returned 0x0
[0160.256] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70
[0160.256] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6e3e70 | out: pszPath="C:\\Windows\\system32") returned 0x0
[0160.258] CoTaskMemFree (pv=0x6e3e70)
[0160.258] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70
[0160.258] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath=0x6e3e70, pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc | out: pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc) returned 1
[0160.286] CoTaskMemFree (pv=0x0)
[0160.286] CoTaskMemFree (pv=0x6e3e70)
[0160.287] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7ce0001
[0160.326] CoTaskMemAlloc (cb=0x3ec) returned 0x6e3e70
[0160.326] LoadStringW (in: hInstance=0x7ce0001, uID=0x140, lpBuffer=0x6e3e70, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c
[0160.327] CoTaskMemFree (pv=0x6e3e70)
[0160.327] FreeLibrary (hLibModule=0x7ce0001) returned 1
[0160.328] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70
[0160.328] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6e3e70 | out: pszPath="C:\\Windows\\system32") returned 0x0
[0160.328] CoTaskMemFree (pv=0x6e3e70)
[0160.328] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70
[0160.328] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath=0x6e3e70, pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc | out: pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc) returned 1
[0160.333] CoTaskMemFree (pv=0x0)
[0160.333] CoTaskMemFree (pv=0x6e3e70)
[0160.333] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7ce0001
[0160.338] CoTaskMemAlloc (cb=0x3ec) returned 0x6e3e70
[0160.338] LoadStringW (in: hInstance=0x7ce0001, uID=0x142, lpBuffer=0x6e3e70, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17
[0160.338] CoTaskMemFree (pv=0x6e3e70)
[0160.338] FreeLibrary (hLibModule=0x7ce0001) returned 1
[0160.338] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70
[0160.338] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x6e3e70 | out: pszPath="C:\\Windows\\system32") returned 0x0
[0160.339] CoTaskMemFree (pv=0x6e3e70)
[0160.339] CoTaskMemAlloc (cb=0x20c) returned 0x6e3e70
[0160.339] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath=0x6e3e70, pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc | out: pwszLanguage=0x0, pcchLanguage=0x19eb04, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19eb08, pululEnumerator=0x19eafc) returned 1
[0160.342] CoTaskMemFree (pv=0x0)
[0160.342] CoTaskMemFree (pv=0x6e3e70)
[0160.342] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7ce0001
[0160.345] CoTaskMemAlloc (cb=0x3ec) returned 0x6e3e70
[0160.345] LoadStringW (in: hInstance=0x7ce0001, uID=0x141, lpBuffer=0x6e3e70, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17
[0160.345] CoTaskMemFree (pv=0x6e3e70)
[0160.345] FreeLibrary (hLibModule=0x7ce0001) returned 1
[0160.347] RegCloseKey (hKey=0x4bc) returned 0x0
[0160.349] SetEvent (hEvent=0x36c) returned 1
[0160.368] SetEvent (hEvent=0x36c) returned 1
[0160.373] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4d8
[0160.374] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4dc
[0160.374] ioctlsocket (in: s=0x4d8, cmd=-2147195266, argp=0x19ed64 | out: argp=0x19ed64) returned 0
[0160.374] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e0
[0160.374] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4e4
[0160.374] ioctlsocket (in: s=0x4e0, cmd=-2147195266, argp=0x19ed64 | out: argp=0x19ed64) returned 0
[0160.374] WSAIoctl (in: s=0x4d8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19ed4c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19ed4c, lpOverlapped=0x0) returned -1
[0160.375] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ea7c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
[0160.375] WSAEventSelect (s=0x4d8, hEventObject=0x4dc, lNetworkEvents=512) returned 0
[0160.375] WSAIoctl (in: s=0x4e0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19ed4c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19ed4c, lpOverlapped=0x0) returned -1
[0160.375] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ea7c, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45
[0160.375] WSAEventSelect (s=0x4e0, hEventObject=0x4e4, lNetworkEvents=512) returned 0
[0160.388] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x19ed48*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x19ed48*=0xa78) returned 0x6f
[0160.395] LocalAlloc (uFlags=0x0, uBytes=0xa78) returned 0x6e9e00
[0160.395] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x6e9e00, SizePointer=0x19ed48*=0xa78 | out: AdapterAddresses=0x6e9e00*(Alignment=0x500000178, Length=0x178, IfIndex=0x5, Next=0x6ea0a8, AdapterName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", FirstUnicastAddress=0x6ea01c, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection", FriendlyName="Ethernet", PhysicalAddress=([0]=0xe8, [1]=0x7a, [2]=0xf3, [3]=0x1e, [4]=0xbb, [5]=0x8b, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x5, ZoneIndices=([0]=0x5, [1]=0x5, [2]=0x5, [3]=0x5, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008000000000, Dhcpv4Server.lpSockaddr=0x6e9f78*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x300053a, FirstDnsSuffix=0x0), SizePointer=0x19ed48*=0xa78) returned 0x0
[0160.411] LocalFree (hMem=0x6e9e00) returned 0x0
[0160.424] CoTaskMemAlloc (cb=0x20c) returned 0x6e9e00
[0160.424] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x6e9e00, nSize=0x104 | out: lpBuffer="") returned 0x0
[0160.425] CoTaskMemFree (pv=0x6e9e00)
[0160.425] CoTaskMemAlloc (cb=0x20c) returned 0x6e9e00
[0160.425] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x6e9e00, nSize=0x104 | out: lpBuffer="") returned 0x0
[0160.425] CoTaskMemFree (pv=0x6e9e00)
[0160.434] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4e8
[0160.437] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x4ec
[0160.440] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19eb50*=0x4dc, lpdwindex=0x19e96c | out: lpdwindex=0x19e96c) returned 0x80010115
[0160.441] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x19eb50*=0x4e4, lpdwindex=0x19e96c | out: lpdwindex=0x19e96c) returned 0x80010115
[0160.445] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ebd4 | out: phkResult=0x19ebd4*=0x4f0) returned 0x0
[0160.445] RegQueryValueExW (in: hKey=0x4f0, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x19ebf0, lpData=0x0, lpcbData=0x19ebec*=0x0 | out: lpType=0x19ebf0*=0x0, lpData=0x0, lpcbData=0x19ebec*=0x0) returned 0x2
[0160.445] RegCloseKey (hKey=0x4f0) returned 0x0
[0160.447] WSAConnect (in: s=0x4e8, name=0x23072f4*(sa_family=2, sin_port=0x2c50, sin_addr="192.30.89.67"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned -1
[0181.514] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x274c, dwLanguageId=0x0, lpBuffer=0x19e9dc, nSize=0x101, Arguments=0x0 | out: lpBuffer="A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.\r\n") returned 0xb9
[0181.593] setsockopt (s=0x4e8, level=65535, optname=128, optval="\x01", optlen=4) returned 0
[0181.594] closesocket (s=0x4e8) returned 0
[0181.594] setsockopt (s=0x4ec, level=65535, optname=128, optval="\x01", optlen=4) returned 0
[0181.594] closesocket (s=0x4ec) returned 0
[0181.631] GetProcessWindowStation () returned 0xd0
[0181.635] GetUserObjectInformationA (in: hObj=0xd0, nIndex=1, pvInfo=0x230a084, nLength=0xc, lpnLengthNeeded=0x19eff0 | out: pvInfo=0x230a084, lpnLengthNeeded=0x19eff0) returned 1
[0181.672] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0181.673] AdjustWindowRectEx (in: lpRect=0x19eed0, dwStyle=0x56010000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eed0) returned 1
[0181.674] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0181.675] AdjustWindowRectEx (in: lpRect=0x19eecc, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eecc) returned 1
[0181.678] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0181.678] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eec8) returned 1
[0181.679] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0181.679] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eec8) returned 1
[0181.679] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0181.679] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eec8) returned 1
[0181.680] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0181.680] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19eec8) returned 1
[0181.682] GetDC (hWnd=0x0) returned 0x110106ca
[0181.683] GdipCreateFromHDC (hdc=0x110106ca, graphics=0x19eda0) returned 0x0
[0181.684] GdipGetFontHeight (font=0x48aefc0, graphics=0x5b3f268, height=0x19ed98) returned 0x0
[0181.685] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0
[0181.685] ReleaseDC (hWnd=0x0, hDC=0x110106ca) returned 1
[0181.689] GetSystemMetrics (nIndex=5) returned 1
[0181.689] GetSystemMetrics (nIndex=6) returned 1
[0181.690] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0181.692] AdjustWindowRectEx (in: lpRect=0x19eec8, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19eec8) returned 1
[0181.692] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0181.693] AdjustWindowRectEx (in: lpRect=0x19ee9c, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19ee9c) returned 1
[0182.236] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", lpFilePart=0x0) returned 0x3a
[0182.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1
[0182.236] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorlib.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6123a4b2, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x6123a4b2, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x6126070c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x53a8a8)) returned 1
[0182.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1
[0182.238] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x81c
[0182.357] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorlib.dll", dwHandle=0x0, dwLen=0x81c, lpData=0x23176d8 | out: lpData=0x23176d8) returned 1
[0182.391] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2317ae0, puLen=0x19eec4) returned 1
[0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317790, puLen=0x19ee44) returned 1
[0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23177e4, puLen=0x19ee44) returned 1
[0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317864, puLen=0x19ee44) returned 1
[0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23178c4, puLen=0x19ee44) returned 1
[0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317904, puLen=0x19ee44) returned 1
[0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231798c, puLen=0x19ee44) returned 1
[0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23179c8, puLen=0x19ee44) returned 1
[0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317a20, puLen=0x19ee44) returned 1
[0182.393] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317a50, puLen=0x19ee44) returned 1
[0182.394] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.394] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2317a8c, puLen=0x19ee44) returned 1
[0182.394] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.394] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2317ae0, puLen=0x19ee38) returned 1
[0182.394] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0182.603] VerQueryValueW (in: pBlock=0x23176d8, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x2317700, puLen=0x19ee48) returned 1
[0182.650] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19e990, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16
[0182.651] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe", lpFilePart=0x0) returned 0x33
[0182.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1
[0182.652] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\svhost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\svhost.exe"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10233118, ftCreationTime.dwHighDateTime=0x1d858a0, ftLastAccessTime.dwLowDateTime=0x10233118, ftLastAccessTime.dwHighDateTime=0x1d858a0, ftLastWriteTime.dwLowDateTime=0x611edffd, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3f938)) returned 1
[0182.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1
[0182.652] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x5ec
[0182.652] GetFileVersionInfoW (in: lptstrFilename="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", dwHandle=0x0, dwLen=0x5ec, lpData=0x23199ec | out: lpData=0x23199ec) returned 1
[0182.652] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2319a88, puLen=0x19eec4) returned 1
[0182.652] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319b00, puLen=0x19ee44) returned 1
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319b2c, puLen=0x19ee44) returned 1
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319b54, puLen=0x19ee44) returned 1
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319b84, puLen=0x19ee44) returned 1
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319bc0, puLen=0x19ee44) returned 1
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319c38, puLen=0x19ee44) returned 1
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319c6c, puLen=0x19ee44) returned 1
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319c98, puLen=0x19ee44) returned 1
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319ade, puLen=0x19ee44) returned 1
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2319c08, puLen=0x19ee44) returned 1
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2319a88, puLen=0x19ee38) returned 1
[0182.653] VerLanguageNameW (in: wLang=0x0, szLang=0x19ebcc, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10
[0182.653] VerQueryValueW (in: pBlock=0x23199ec, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x2319a14, puLen=0x19ee48) returned 1
[0182.654] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77
[0182.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1
[0182.655] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.windows.forms\\v4.0_4.0.0.0__b77a5c561934e089\\system.windows.forms.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5508362a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5508362a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5508362a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4944d8)) returned 1
[0182.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1
[0182.655] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x7fc
[0182.661] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", dwHandle=0x0, dwLen=0x7fc, lpData=0x231b9b4 | out: lpData=0x231b9b4) returned 1
[0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x231bdac, puLen=0x19eec4) returned 1
[0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231ba6c, puLen=0x19ee44) returned 1
[0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bac0, puLen=0x19ee44) returned 1
[0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bb00, puLen=0x19ee44) returned 1
[0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bb60, puLen=0x19ee44) returned 1
[0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bbb8, puLen=0x19ee44) returned 1
[0182.662] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bc40, puLen=0x19ee44) returned 1
[0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bc94, puLen=0x19ee44) returned 1
[0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bcec, puLen=0x19ee44) returned 1
[0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bd1c, puLen=0x19ee44) returned 1
[0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231bd58, puLen=0x19ee44) returned 1
[0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x231bdac, puLen=0x19ee38) returned 1
[0182.663] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0182.663] VerQueryValueW (in: pBlock=0x231b9b4, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x231b9dc, puLen=0x19ee48) returned 1
[0182.744] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", lpFilePart=0x0) returned 0x5b
[0182.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1
[0182.744] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system\\v4.0_4.0.0.0__b77a5c561934e089\\system.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56075192, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x56075192, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5609b3ed, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x352688)) returned 1
[0182.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1
[0182.745] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x78c
[0182.806] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\System.dll", dwHandle=0x0, dwLen=0x78c, lpData=0x231dc5c | out: lpData=0x231dc5c) returned 1
[0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x231e01c, puLen=0x19eec4) returned 1
[0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231dd14, puLen=0x19ee44) returned 1
[0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231dd68, puLen=0x19ee44) returned 1
[0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231dda8, puLen=0x19ee44) returned 1
[0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231de08, puLen=0x19ee44) returned 1
[0182.808] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231de44, puLen=0x19ee44) returned 1
[0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231decc, puLen=0x19ee44) returned 1
[0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231df04, puLen=0x19ee44) returned 1
[0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231df5c, puLen=0x19ee44) returned 1
[0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231df8c, puLen=0x19ee44) returned 1
[0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x231dfc8, puLen=0x19ee44) returned 1
[0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x231e01c, puLen=0x19ee38) returned 1
[0182.809] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0182.809] VerQueryValueW (in: pBlock=0x231dc5c, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x231dc84, puLen=0x19ee48) returned 1
[0182.810] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpFilePart=0x0) returned 0x6b
[0182.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1
[0182.811] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.drawing.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53cd8003, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x53cd8003, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x53cd8003, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x90eb0)) returned 1
[0182.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1
[0182.811] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x7cc
[0182.832] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll", dwHandle=0x0, dwLen=0x7cc, lpData=0x2320040 | out: lpData=0x2320040) returned 1
[0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2320420, puLen=0x19eec4) returned 1
[0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23200f8, puLen=0x19ee44) returned 1
[0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x232014c, puLen=0x19ee44) returned 1
[0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x232018c, puLen=0x19ee44) returned 1
[0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23201ec, puLen=0x19ee44) returned 1
[0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2320238, puLen=0x19ee44) returned 1
[0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23202c0, puLen=0x19ee44) returned 1
[0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2320308, puLen=0x19ee44) returned 1
[0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2320360, puLen=0x19ee44) returned 1
[0182.833] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2320390, puLen=0x19ee44) returned 1
[0182.834] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.834] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23203cc, puLen=0x19ee44) returned 1
[0182.834] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.834] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2320420, puLen=0x19ee38) returned 1
[0182.834] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0182.834] VerQueryValueW (in: pBlock=0x2320040, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x2320068, puLen=0x19ee48) returned 1
[0182.835] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", lpFilePart=0x0) returned 0x65
[0182.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1
[0182.836] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.core\\v4.0_4.0.0.0__b77a5c561934e089\\system.core.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x539dd101, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x539dd101, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x539dd101, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1406a0)) returned 1
[0182.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1
[0182.837] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x7ac
[0182.870] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Core\\v4.0_4.0.0.0__b77a5c561934e089\\System.Core.dll", dwHandle=0x0, dwLen=0x7ac, lpData=0x2322354 | out: lpData=0x2322354) returned 1
[0182.871] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2322724, puLen=0x19eec4) returned 1
[0182.871] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x232240c, puLen=0x19ee44) returned 1
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2322460, puLen=0x19ee44) returned 1
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23224a0, puLen=0x19ee44) returned 1
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2322500, puLen=0x19ee44) returned 1
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2322544, puLen=0x19ee44) returned 1
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23225cc, puLen=0x19ee44) returned 1
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x232260c, puLen=0x19ee44) returned 1
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2322664, puLen=0x19ee44) returned 1
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2322694, puLen=0x19ee44) returned 1
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23226d0, puLen=0x19ee44) returned 1
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2322724, puLen=0x19ee38) returned 1
[0182.872] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0182.872] VerQueryValueW (in: pBlock=0x2322354, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x232237c, puLen=0x19ee48) returned 1
[0182.874] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll", lpFilePart=0x0) returned 0x77
[0182.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1
[0182.874] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\system.configuration.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55010f1a, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x55010f1a, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x55010f1a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x61ed0)) returned 1
[0182.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1
[0182.874] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x824
[0182.888] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Configuration\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Configuration.dll", dwHandle=0x0, dwLen=0x824, lpData=0x2324898 | out: lpData=0x2324898) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2324ca4, puLen=0x19eec4) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324950, puLen=0x19ee44) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23249a4, puLen=0x19ee44) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x23249f8, puLen=0x19ee44) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324a58, puLen=0x19ee44) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324ab0, puLen=0x19ee44) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324b38, puLen=0x19ee44) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324b8c, puLen=0x19ee44) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324be4, puLen=0x19ee44) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324c14, puLen=0x19ee44) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2324c50, puLen=0x19ee44) returned 1
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2324ca4, puLen=0x19ee38) returned 1
[0182.889] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0182.889] VerQueryValueW (in: pBlock=0x2324898, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x23248c0, puLen=0x19ee48) returned 1
[0182.891] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll", nBufferLength=0x105, lpBuffer=0x19e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll", lpFilePart=0x0) returned 0x63
[0182.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19ee04) returned 1
[0182.891] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.xml\\v4.0_4.0.0.0__b77a5c561934e089\\system.xml.dll"), fInfoLevelId=0x0, lpFileInformation=0x19ee80 | out: lpFileInformation=0x19ee80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56002a86, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x56002a86, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x56002a86, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x284ea0)) returned 1
[0182.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19ee00) returned 1
[0182.892] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll", lpdwHandle=0x19eef4 | out: lpdwHandle=0x19eef4) returned 0x7ac
[0182.939] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Xml\\v4.0_4.0.0.0__b77a5c561934e089\\System.Xml.dll", dwHandle=0x0, dwLen=0x7ac, lpData=0x2326c44 | out: lpData=0x2326c44) returned 1
[0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19eec8, puLen=0x19eec4 | out: lplpBuffer=0x19eec8*=0x2327014, puLen=0x19eec4) returned 1
[0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326cfc, puLen=0x19ee44) returned 1
[0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326d50, puLen=0x19ee44) returned 1
[0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326d90, puLen=0x19ee44) returned 1
[0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326df0, puLen=0x19ee44) returned 1
[0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326e34, puLen=0x19ee44) returned 1
[0182.940] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326ebc, puLen=0x19ee44) returned 1
[0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326efc, puLen=0x19ee44) returned 1
[0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326f54, puLen=0x19ee44) returned 1
[0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326f84, puLen=0x19ee44) returned 1
[0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x2326fc0, puLen=0x19ee44) returned 1
[0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19ee48, puLen=0x19ee44 | out: lplpBuffer=0x19ee48*=0x0, puLen=0x19ee44) returned 0
[0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19ee3c, puLen=0x19ee38 | out: lplpBuffer=0x19ee3c*=0x2327014, puLen=0x19ee38) returned 1
[0182.941] VerLanguageNameW (in: wLang=0x409, szLang=0x19ebcc, cchLang=0x100 | out: szLang="English (United States)") returned 0x17
[0182.941] VerQueryValueW (in: pBlock=0x2326c44, lpSubBlock="\\", lplpBuffer=0x19ee4c, puLen=0x19ee48 | out: lplpBuffer=0x19ee4c*=0x2326c6c, puLen=0x19ee48) returned 1
[0182.942] GetCurrentActCtx (in: lphActCtx=0x19ee74 | out: lphActCtx=0x19ee74*=0x689cf4) returned 1
[0182.942] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0182.949] GetCurrentActCtx (in: lphActCtx=0x19edfc | out: lphActCtx=0x19edfc*=0x689cf4) returned 1
[0182.950] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0182.950] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0182.950] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="WindowsFormsParkingWindow", dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x601fe
[0182.952] SetWindowLongW (hWnd=0x601fe, nIndex=-4, dwNewLong=2004528864) returned 76678590
[0182.952] GetWindowLongW (hWnd=0x601fe, nIndex=-4) returned 2004528864
[0182.953] SetWindowLongW (hWnd=0x601fe, nIndex=-4, dwNewLong=76678830) returned 2004528864
[0182.953] GetWindowLongW (hWnd=0x601fe, nIndex=-4) returned 76678830
[0182.953] GetWindowLongW (hWnd=0x601fe, nIndex=-16) returned 113311744
[0182.953] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x24, wParam=0x0, lParam=0x19e82c) returned 0x0
[0182.953] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x81, wParam=0x0, lParam=0x19e820) returned 0x1
[0182.954] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x83, wParam=0x0, lParam=0x19e80c) returned 0x0
[0182.955] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x1, wParam=0x0, lParam=0x19e820) returned 0x0
[0182.955] GetClientRect (in: hWnd=0x601fe, lpRect=0x19e530 | out: lpRect=0x19e530) returned 1
[0182.955] GetWindowRect (in: hWnd=0x601fe, lpRect=0x19e530 | out: lpRect=0x19e530) returned 1
[0182.955] SetWindowTextW (hWnd=0x601fe, lpString="WindowsFormsParkingWindow") returned 1
[0182.955] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0xc, wParam=0x0, lParam=0x232d0a0) returned 0x1
[0182.956] GetParent (hWnd=0x601fe) returned 0x0
[0182.957] GetClassInfoW (in: hInstance=0x0, lpClassName="STATIC", lpWndClass=0x232d330 | out: lpWndClass=0x232d330) returned 1
[0182.959] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0182.960] CoTaskMemAlloc (cb=0x58) returned 0x68c5e8
[0182.960] RegisterClassW (lpWndClass=0x19ed2c) returned 0xc20b
[0182.960] CoTaskMemFree (pv=0x68c5e8)
[0182.961] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0182.961] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.STATIC.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x5600000d, X=0, Y=0, nWidth=100, nHeight=23, hWndParent=0x601fe, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x801f0
[0182.963] SetWindowLongW (hWnd=0x801f0, nIndex=-4, dwNewLong=1862396288) returned 76678870
[0182.963] GetWindowLongW (hWnd=0x801f0, nIndex=-4) returned 1862396288
[0182.964] SetWindowLongW (hWnd=0x801f0, nIndex=-4, dwNewLong=76678326) returned 1862396288
[0182.964] GetWindowLongW (hWnd=0x801f0, nIndex=-4) returned 76678326
[0182.964] GetWindowLongW (hWnd=0x801f0, nIndex=-16) returned 1174405133
[0182.964] GetWindowLongW (hWnd=0x801f0, nIndex=-12) returned 0
[0182.964] SetWindowLongW (hWnd=0x801f0, nIndex=-12, dwNewLong=524784) returned 0
[0182.964] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x81, wParam=0x0, lParam=0x19e898) returned 0x1
[0182.967] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x83, wParam=0x0, lParam=0x19e884) returned 0x0
[0182.967] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x1, wParam=0x0, lParam=0x19e898) returned 0x0
[0182.970] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e588 | out: lpRect=0x19e588) returned 1
[0182.970] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e588 | out: lpRect=0x19e588) returned 1
[0182.970] GetParent (hWnd=0x801f0) returned 0x601fe
[0182.970] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601fe, lpPoints=0x19e588, cPoints=0x2 | out: lpPoints=0x19e588) returned -1966088
[0182.971] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0
[0182.971] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
[0182.971] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e5e0 | out: lpRect=0x19e5e0) returned 1
[0182.971] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e5e0 | out: lpRect=0x19e5e0) returned 1
[0182.972] GetParent (hWnd=0x801f0) returned 0x601fe
[0182.972] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601fe, lpPoints=0x19e5e0, cPoints=0x2 | out: lpPoints=0x19e5e0) returned -1966088
[0182.972] SendMessageW (hWnd=0x801f0, Msg=0x2210, wParam=0x1f00001, lParam=0x801f0) returned 0x0
[0182.972] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x2210, wParam=0x1f00001, lParam=0x801f0) returned 0x0
[0182.972] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0182.973] GetParent (hWnd=0x801f0) returned 0x601fe
[0182.973] GdipCreateFromHWND (hwnd=0x801f0, graphics=0x19eef8) returned 0x0
[0183.072] GdipMeasureString (graphics=0x5b3f268, string="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.", length=242, font=0x48aefc0, layoutRect=0x19eec0, stringFormat=0x0, boundingBox=0x19eeb0, codepointsFitted=0x19eeac, linesFilled=0x19eea8) returned 0x0
[0183.189] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0
[0183.189] GetForegroundWindow () returned 0x40268
[0183.305] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0183.306] GetCursorPos (in: lpPoint=0x232d77c | out: lpPoint=0x232d77c*(x=1155, y=87)) returned 1
[0183.350] MonitorFromPoint (pt=0x483, dwFlags=0x57) returned 0x10001
[0183.351] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19eca0 | out: lpmi=0x19eca0) returned 1
[0183.351] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x40105e1
[0183.351] GetDeviceCaps (hdc=0x40105e1, index=12) returned 32
[0183.352] GetDeviceCaps (hdc=0x40105e1, index=14) returned 1
[0183.352] DeleteDC (hdc=0x40105e1) returned 1
[0183.353] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ecf4 | out: lpmi=0x19ecf4) returned 1
[0183.353] AdjustWindowRectEx (in: lpRect=0x19ee8c, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19ee8c) returned 1
[0183.353] GetSystemMetrics (nIndex=59) returned 1456
[0183.353] GetSystemMetrics (nIndex=60) returned 916
[0183.353] GetSystemMetrics (nIndex=34) returned 136
[0183.353] GetSystemMetrics (nIndex=35) returned 39
[0183.355] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0183.355] GetCursorPos (in: lpPoint=0x232da18 | out: lpPoint=0x232da18*(x=1155, y=87)) returned 1
[0183.355] MonitorFromPoint (pt=0x481, dwFlags=0x59) returned 0x10001
[0183.355] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19eba4 | out: lpmi=0x19eba4) returned 1
[0183.356] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x50105e1
[0183.356] GetDeviceCaps (hdc=0x50105e1, index=12) returned 32
[0183.356] GetDeviceCaps (hdc=0x50105e1, index=14) returned 1
[0183.356] DeleteDC (hdc=0x50105e1) returned 1
[0183.356] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ebf8 | out: lpmi=0x19ebf8) returned 1
[0183.356] AdjustWindowRectEx (in: lpRect=0x19ed8c, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19ed8c) returned 1
[0183.397] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0183.398] AdjustWindowRectEx (in: lpRect=0x19ee58, dwStyle=0x56000000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee58) returned 1
[0183.498] LoadIconW (hInstance=0x0, lpIconName=0x7f01) returned 0x1002d
[0183.521] GetIconInfo (in: hIcon=0x1002d, piconinfo=0x232ddbc | out: piconinfo=0x232ddbc) returned 1
[0183.541] GetObjectW (in: h=0xae0509ae, c=24, pv=0x232ddd8 | out: pv=0x232ddd8) returned 24
[0183.542] GdipCreateBitmapFromHBITMAP (hbm=0xae0509ae, hpal=0x0, bitmap=0x19ede4) returned 0x0
[0183.544] GdipGetImageWidth (image=0x5b3f268, width=0x19ee00) returned 0x0
[0183.544] GdipGetImageHeight (image=0x5b3f268, height=0x19edfc) returned 0x0
[0183.544] GdipGetImagePixelFormat (image=0x5b3f268, format=0x19edf4) returned 0x0
[0183.545] GdipBitmapLockBits (bitmap=0x5b3f268, rect=0x19edb8, flags=0x1, format=0x22009, lockedBitmapData=0x232deac) returned 0x0
[0183.547] GdipCreateBitmapFromScan0 (width=32, height=32, stride=0, format=0x26200a, scan0=0x0, bitmap=0x19edf4) returned 0x0
[0183.547] GdipBitmapLockBits (bitmap=0x5b3f598, rect=0x19edb8, flags=0x2, format=0x26200a, lockedBitmapData=0x232dee4) returned 0x0
[0183.551] RtlMoveMemory (in: Destination=0x5b45628, Source=0x5b4aef0, Length=0x80 | out: Destination=0x5b45628)
[0183.552] RtlMoveMemory (in: Destination=0x5b456a8, Source=0x5b4ae70, Length=0x80 | out: Destination=0x5b456a8)
[0183.552] RtlMoveMemory (in: Destination=0x5b45728, Source=0x5b4adf0, Length=0x80 | out: Destination=0x5b45728)
[0183.552] RtlMoveMemory (in: Destination=0x5b457a8, Source=0x5b4ad70, Length=0x80 | out: Destination=0x5b457a8)
[0183.552] RtlMoveMemory (in: Destination=0x5b45828, Source=0x5b4acf0, Length=0x80 | out: Destination=0x5b45828)
[0183.552] RtlMoveMemory (in: Destination=0x5b458a8, Source=0x5b4ac70, Length=0x80 | out: Destination=0x5b458a8)
[0183.552] RtlMoveMemory (in: Destination=0x5b45928, Source=0x5b4abf0, Length=0x80 | out: Destination=0x5b45928)
[0183.552] RtlMoveMemory (in: Destination=0x5b459a8, Source=0x5b4ab70, Length=0x80 | out: Destination=0x5b459a8)
[0183.552] RtlMoveMemory (in: Destination=0x5b45a28, Source=0x5b4aaf0, Length=0x80 | out: Destination=0x5b45a28)
[0183.552] RtlMoveMemory (in: Destination=0x5b45aa8, Source=0x5b4aa70, Length=0x80 | out: Destination=0x5b45aa8)
[0183.552] RtlMoveMemory (in: Destination=0x5b45b28, Source=0x5b4a9f0, Length=0x80 | out: Destination=0x5b45b28)
[0183.552] RtlMoveMemory (in: Destination=0x5b45ba8, Source=0x5b4a970, Length=0x80 | out: Destination=0x5b45ba8)
[0183.552] RtlMoveMemory (in: Destination=0x5b45c28, Source=0x5b4a8f0, Length=0x80 | out: Destination=0x5b45c28)
[0183.552] RtlMoveMemory (in: Destination=0x5b45ca8, Source=0x5b4a870, Length=0x80 | out: Destination=0x5b45ca8)
[0183.552] RtlMoveMemory (in: Destination=0x5b45d28, Source=0x5b4a7f0, Length=0x80 | out: Destination=0x5b45d28)
[0183.552] RtlMoveMemory (in: Destination=0x5b45da8, Source=0x5b4a770, Length=0x80 | out: Destination=0x5b45da8)
[0183.552] RtlMoveMemory (in: Destination=0x5b45e28, Source=0x5b4a6f0, Length=0x80 | out: Destination=0x5b45e28)
[0183.552] RtlMoveMemory (in: Destination=0x5b45ea8, Source=0x5b4a670, Length=0x80 | out: Destination=0x5b45ea8)
[0183.552] RtlMoveMemory (in: Destination=0x5b45f28, Source=0x5b4a5f0, Length=0x80 | out: Destination=0x5b45f28)
[0183.552] RtlMoveMemory (in: Destination=0x5b45fa8, Source=0x5b4a570, Length=0x80 | out: Destination=0x5b45fa8)
[0183.553] RtlMoveMemory (in: Destination=0x5b46028, Source=0x5b4a4f0, Length=0x80 | out: Destination=0x5b46028)
[0183.553] RtlMoveMemory (in: Destination=0x5b460a8, Source=0x5b4a470, Length=0x80 | out: Destination=0x5b460a8)
[0183.553] RtlMoveMemory (in: Destination=0x5b46128, Source=0x5b4a3f0, Length=0x80 | out: Destination=0x5b46128)
[0183.553] RtlMoveMemory (in: Destination=0x5b461a8, Source=0x5b4a370, Length=0x80 | out: Destination=0x5b461a8)
[0183.553] RtlMoveMemory (in: Destination=0x5b46228, Source=0x5b4a2f0, Length=0x80 | out: Destination=0x5b46228)
[0183.553] RtlMoveMemory (in: Destination=0x5b462a8, Source=0x5b4a270, Length=0x80 | out: Destination=0x5b462a8)
[0183.553] RtlMoveMemory (in: Destination=0x5b46328, Source=0x5b4a1f0, Length=0x80 | out: Destination=0x5b46328)
[0183.553] RtlMoveMemory (in: Destination=0x5b463a8, Source=0x5b4a170, Length=0x80 | out: Destination=0x5b463a8)
[0183.553] RtlMoveMemory (in: Destination=0x5b46428, Source=0x5b4a0f0, Length=0x80 | out: Destination=0x5b46428)
[0183.553] RtlMoveMemory (in: Destination=0x5b464a8, Source=0x5b4a070, Length=0x80 | out: Destination=0x5b464a8)
[0183.553] RtlMoveMemory (in: Destination=0x5b46528, Source=0x5b49ff0, Length=0x80 | out: Destination=0x5b46528)
[0183.553] RtlMoveMemory (in: Destination=0x5b465a8, Source=0x5b49f70, Length=0x80 | out: Destination=0x5b465a8)
[0183.553] GdipBitmapUnlockBits (bitmap=0x5b3f268, lockedBitmapData=0x232deac) returned 0x0
[0183.554] GdipBitmapUnlockBits (bitmap=0x5b3f598, lockedBitmapData=0x232dee4) returned 0x0
[0183.554] GdipDisposeImage (image=0x5b3f268) returned 0x0
[0183.554] DeleteObject (ho=0xae0509ae) returned 1
[0183.554] DeleteObject (ho=0x60505e1) returned 1
[0183.554] GetCurrentThreadId () returned 0xbf8
[0183.554] GetCurrentThreadId () returned 0xbf8
[0183.558] SetWindowPos (hWnd=0x801f0, hWndInsertAfter=0x0, X=64, Y=8, cx=354, cy=68, uFlags=0x14) returned 1
[0183.559] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x46, wParam=0x0, lParam=0x19edd4) returned 0x0
[0183.559] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x83, wParam=0x1, lParam=0x19edac) returned 0x0
[0183.562] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x47, wParam=0x0, lParam=0x19edd4) returned 0x0
[0183.562] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x3, wParam=0x0, lParam=0x80040) returned 0x0
[0183.562] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e4f4 | out: lpRect=0x19e4f4) returned 1
[0183.562] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e4f4 | out: lpRect=0x19e4f4) returned 1
[0183.562] GetParent (hWnd=0x801f0) returned 0x601fe
[0183.562] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601fe, lpPoints=0x19e4f4, cPoints=0x2 | out: lpPoints=0x19e4f4) returned -1966088
[0183.562] InvalidateRect (hWnd=0x801f0, lpRect=0x0, bErase=1) returned 1
[0183.563] GetWindowTextLengthW (hWnd=0x801f0) returned 0
[0183.563] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0183.563] GetSystemMetrics (nIndex=42) returned 0
[0183.563] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19e384, nMaxCount=1 | out: lpString="") returned 0
[0183.563] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0x1, lParam=0x19e384) returned 0x0
[0183.563] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x5, wParam=0x0, lParam=0x440162) returned 0x0
[0183.563] GetClientRect (in: hWnd=0x801f0, lpRect=0x19ead8 | out: lpRect=0x19ead8) returned 1
[0183.563] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19ead8 | out: lpRect=0x19ead8) returned 1
[0183.564] GetParent (hWnd=0x801f0) returned 0x601fe
[0183.564] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0x601fe, lpPoints=0x19ead8, cPoints=0x2 | out: lpPoints=0x19ead8) returned -1966088
[0183.567] GetWindowTextLengthW (hWnd=0x801f0) returned 0
[0183.567] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0183.567] GetSystemMetrics (nIndex=42) returned 0
[0183.567] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19ee30, nMaxCount=1 | out: lpString="") returned 0
[0183.567] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0x1, lParam=0x19ee30) returned 0x0
[0183.567] GetWindowTextLengthW (hWnd=0x801f0) returned 0
[0183.567] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0183.567] GetSystemMetrics (nIndex=42) returned 0
[0183.567] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19ee2c, nMaxCount=1 | out: lpString="") returned 0
[0183.567] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0x1, lParam=0x19ee2c) returned 0x0
[0183.568] SetWindowTextW (hWnd=0x801f0, lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.") returned 1
[0183.568] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xc, wParam=0x0, lParam=0x230c918) returned 0x1
[0183.568] InvalidateRect (hWnd=0x801f0, lpRect=0x0, bErase=1) returned 1
[0183.568] GetCurrentThreadId () returned 0xbf8
[0183.569] GetWindowThreadProcessId (in: hWnd=0x801f0, lpdwProcessId=0x19eeb8 | out: lpdwProcessId=0x19eeb8) returned 0xbf8
[0183.587] GdipCreateBitmapFromStream (stream=0x8650030, bitmap=0x19eef4) returned 0x0
[0183.949] GdipImageForceValidation (image=0x5b3f268) returned 0x0
[0183.954] GdipGetImageRawFormat (image=0x5b3f268, format=0x19ee74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0183.957] GdipGetImageHeight (image=0x5b3f268, height=0x19eed8) returned 0x0
[0183.957] GdipGetImageWidth (image=0x5b3f268, width=0x19eed8) returned 0x0
[0183.957] GdipGetImageWidth (image=0x5b3f268, width=0x19eec4) returned 0x0
[0183.957] GdipGetImageHeight (image=0x5b3f268, height=0x19eec4) returned 0x0
[0183.957] GdipGetImageWidth (image=0x5b3f268, width=0x19eeb4) returned 0x0
[0183.957] GdipGetImageHeight (image=0x5b3f268, height=0x19eeb4) returned 0x0
[0183.957] GdipBitmapGetPixel (bitmap=0x5b3f268, x=0, y=15, color=0x19eec4) returned 0x0
[0183.959] GdipGetImageRawFormat (image=0x5b3f268, format=0x19edf4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0183.959] GdipGetImageWidth (image=0x5b3f268, width=0x19edf4) returned 0x0
[0183.959] GdipGetImageHeight (image=0x5b3f268, height=0x19edf4) returned 0x0
[0183.959] GdipCreateBitmapFromScan0 (width=16, height=16, stride=0, format=0x26200a, scan0=0x0, bitmap=0x19edf8) returned 0x0
[0183.959] GdipGetImagePixelFormat (image=0x5b47f18, format=0x19edf4) returned 0x0
[0183.959] GdipGetImageGraphicsContext (image=0x5b47f18, graphics=0x19ee00) returned 0x0
[0183.960] GdipGraphicsClear (graphics=0x5b498b8, color=0xffffff) returned 0x0
[0183.961] GdipCreateImageAttributes (imageattr=0x19ee04) returned 0x0
[0183.961] GdipSetImageAttributesColorKeys (imageattr=0x5b46b80, type=0x0, enableFlag=1, colorLow=0xffc0c0c0, colorHigh=0xffc0c0c0) returned 0x0
[0183.961] GdipDrawImageRectRectI (graphics=0x5b498b8, image=0x5b3f268, dstx=0, dsty=0, dstwidth=16, dstheight=16, srcx=0, srcy=0, srcwidth=16, srcheight=16, srcUnit=0x2, imageAttributes=0x5b46b80, callback=0x0, callbackData=0x0) returned 0x0
[0183.962] GdipDisposeImageAttributes (imageattr=0x5b46b80) returned 0x0
[0183.962] GdipDeleteGraphics (graphics=0x5b498b8) returned 0x0
[0183.962] GdipDisposeImage (image=0x5b3f268) returned 0x0
[0183.963] GdipCreateBitmapFromStream (stream=0x8650010, bitmap=0x19eef4) returned 0x0
[0183.964] GdipImageForceValidation (image=0x5b3f268) returned 0x0
[0183.965] GdipGetImageRawFormat (image=0x5b3f268, format=0x19ee74*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0183.965] GdipGetImageHeight (image=0x5b3f268, height=0x19eed8) returned 0x0
[0183.965] GdipGetImageWidth (image=0x5b3f268, width=0x19eed8) returned 0x0
[0183.965] GdipGetImageWidth (image=0x5b3f268, width=0x19eec4) returned 0x0
[0183.966] GdipGetImageHeight (image=0x5b3f268, height=0x19eec4) returned 0x0
[0183.966] GdipGetImageWidth (image=0x5b3f268, width=0x19eeb4) returned 0x0
[0183.966] GdipGetImageHeight (image=0x5b3f268, height=0x19eeb4) returned 0x0
[0183.966] GdipBitmapGetPixel (bitmap=0x5b3f268, x=0, y=15, color=0x19eec4) returned 0x0
[0183.966] GdipGetImageRawFormat (image=0x5b3f268, format=0x19edf4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0183.966] GdipGetImageWidth (image=0x5b3f268, width=0x19edf4) returned 0x0
[0183.966] GdipGetImageHeight (image=0x5b3f268, height=0x19edf4) returned 0x0
[0183.966] GdipCreateBitmapFromScan0 (width=16, height=16, stride=0, format=0x26200a, scan0=0x0, bitmap=0x19edf8) returned 0x0
[0183.966] GdipGetImagePixelFormat (image=0x5b498b8, format=0x19edf4) returned 0x0
[0183.966] GdipGetImageGraphicsContext (image=0x5b498b8, graphics=0x19ee00) returned 0x0
[0183.966] GdipGraphicsClear (graphics=0x5b49f70, color=0xffffff) returned 0x0
[0183.966] GdipCreateImageAttributes (imageattr=0x19ee04) returned 0x0
[0183.966] GdipSetImageAttributesColorKeys (imageattr=0x5b48478, type=0x0, enableFlag=1, colorLow=0xffc0c0c0, colorHigh=0xffc0c0c0) returned 0x0
[0183.966] GdipDrawImageRectRectI (graphics=0x5b49f70, image=0x5b3f268, dstx=0, dsty=0, dstwidth=16, dstheight=16, srcx=0, srcy=0, srcwidth=16, srcheight=16, srcUnit=0x2, imageAttributes=0x5b48478, callback=0x0, callbackData=0x0) returned 0x0
[0183.967] GdipDisposeImageAttributes (imageattr=0x5b48478) returned 0x0
[0183.967] GdipDeleteGraphics (graphics=0x5b49f70) returned 0x0
[0183.967] GdipDisposeImage (image=0x5b3f268) returned 0x0
[0183.967] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0183.967] AdjustWindowRectEx (in: lpRect=0x19ee70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee70) returned 1
[0183.969] GetCurrentThreadId () returned 0xbf8
[0183.969] GetCurrentThreadId () returned 0xbf8
[0183.970] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0183.970] AdjustWindowRectEx (in: lpRect=0x19ee70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee70) returned 1
[0183.970] GetCurrentThreadId () returned 0xbf8
[0183.970] GetCurrentThreadId () returned 0xbf8
[0183.970] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0183.970] AdjustWindowRectEx (in: lpRect=0x19ee70, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee70) returned 1
[0183.970] GetCurrentThreadId () returned 0xbf8
[0183.970] GetCurrentThreadId () returned 0xbf8
[0183.975] GetSystemMetrics (nIndex=5) returned 1
[0183.975] GetSystemMetrics (nIndex=6) returned 1
[0183.975] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0183.975] AdjustWindowRectEx (in: lpRect=0x19edc4, dwStyle=0x56210044, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19edc4) returned 1
[0183.976] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0183.976] AdjustWindowRectEx (in: lpRect=0x19edc4, dwStyle=0x56210044, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19edc4) returned 1
[0183.979] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0183.979] AdjustWindowRectEx (in: lpRect=0x19ee44, dwStyle=0x563008c4, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19ee44) returned 1
[0183.979] GetCurrentThreadId () returned 0xbf8
[0183.979] GetCurrentThreadId () returned 0xbf8
[0183.987] GetProcessWindowStation () returned 0xd0
[0183.987] GetCapture () returned 0x0
[0183.987] GetActiveWindow () returned 0x0
[0183.988] GetCurrentActCtx (in: lphActCtx=0x19ef00 | out: lphActCtx=0x19ef00*=0x689cf4) returned 1
[0183.988] GetProcessWindowStation () returned 0xd0
[0183.991] OleInitialize (pvReserved=0x0) returned 0x0
[0183.992] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x19ee80 | out: lplpMessageFilter=0x19ee80*=0x0) returned 0x0
[0183.998] GetCurrentThreadId () returned 0xbf8
[0183.998] EnumThreadWindows (dwThreadId=0xbf8, lpfn=0x492058e, lParam=0x0) returned 1
[0183.999] IsWindowVisible (hWnd=0x7032c) returned 0
[0183.999] IsWindowVisible (hWnd=0x802a2) returned 1
[0183.999] IsWindowEnabled (hWnd=0x802a2) returned 1
[0183.999] IsWindowVisible (hWnd=0x40200) returned 0
[0183.999] IsWindowVisible (hWnd=0xc01e4) returned 0
[0183.999] GetActiveWindow () returned 0x0
[0183.999] GetFocus () returned 0x0
[0183.999] IsWindow (hWnd=0x802a2) returned 1
[0184.000] EnableWindow (hWnd=0x802a2, bEnable=0) returned 0
[0184.000] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0
[0184.001] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xa, wParam=0x0, lParam=0x0) returned 0x0
[0184.001] GetCurrentActCtx (in: lphActCtx=0x19edf0 | out: lphActCtx=0x19edf0*=0x689cf4) returned 1
[0184.002] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0184.002] AdjustWindowRectEx (in: lpRect=0x19ed54, dwStyle=0x2c80000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19ed54) returned 1
[0184.002] GetCursorPos (in: lpPoint=0x232f980 | out: lpPoint=0x232f980*(x=1155, y=87)) returned 1
[0184.002] MonitorFromPoint (pt=0x483, dwFlags=0x57) returned 0x10001
[0184.002] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ec30 | out: lpmi=0x19ec30) returned 1
[0184.002] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x70105e1
[0184.002] GetDeviceCaps (hdc=0x70105e1, index=12) returned 32
[0184.002] GetDeviceCaps (hdc=0x70105e1, index=14) returned 1
[0184.002] DeleteDC (hdc=0x70105e1) returned 1
[0184.003] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ec84 | out: lpmi=0x19ec84) returned 1
[0184.003] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0184.003] CreateWindowExW (dwExStyle=0x50001, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName="Microsoft .NET Framework", dwStyle=0x2c80000, X=493, Y=348, nWidth=454, nHeight=164, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0xb004c
[0184.004] SetWindowLongW (hWnd=0xb004c, nIndex=-4, dwNewLong=2004528864) returned 76678590
[0184.004] GetWindowLongW (hWnd=0xb004c, nIndex=-4) returned 2004528864
[0184.004] SetWindowLongW (hWnd=0xb004c, nIndex=-4, dwNewLong=76692046) returned 2004528864
[0184.004] GetWindowLongW (hWnd=0xb004c, nIndex=-4) returned 76692046
[0184.004] GetWindowLongW (hWnd=0xb004c, nIndex=-16) returned 113770496
[0184.005] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x81, wParam=0x0, lParam=0x19e810) returned 0x1
[0184.005] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x83, wParam=0x0, lParam=0x19e7fc) returned 0x0
[0184.006] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x1, wParam=0x0, lParam=0x19e810) returned 0x0
[0184.006] GetClientRect (in: hWnd=0xb004c, lpRect=0x19e50c | out: lpRect=0x19e50c) returned 1
[0184.006] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19e50c | out: lpRect=0x19e50c) returned 1
[0184.007] SetWindowTextW (hWnd=0xb004c, lpString="Microsoft .NET Framework") returned 1
[0184.007] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xc, wParam=0x0, lParam=0x232d650) returned 0x1
[0184.007] GetStartupInfoW (in: lpStartupInfo=0x232fcbc | out: lpStartupInfo=0x232fcbc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\svhost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0))
[0184.008] GetParent (hWnd=0xb004c) returned 0x0
[0184.008] SetWindowLongW (hWnd=0xb004c, nIndex=-8, dwNewLong=0) returned 0
[0184.009] SendMessageW (hWnd=0xb004c, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0
[0184.009] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x80, wParam=0x0, lParam=0x0) returned 0x0
[0184.010] SendMessageW (hWnd=0xb004c, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0
[0184.010] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0
[0184.010] GetSystemMenu (hWnd=0xb004c, bRevert=0) returned 0xa80307
[0184.010] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19ee00 | out: lpwndpl=0x19ee00) returned 1
[0184.011] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf020, uEnable=0x1) returned 0
[0184.011] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf030, uEnable=0x1) returned 0
[0184.011] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf060, uEnable=0x0) returned 0
[0184.011] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf120, uEnable=0x1) returned 0
[0184.011] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf000, uEnable=0x1) returned 0
[0184.011] GetClientRect (in: hWnd=0xb004c, lpRect=0x19ee44 | out: lpRect=0x19ee44) returned 1
[0184.011] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eda4 | out: lpRect=0x19eda4) returned 1
[0184.011] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eda4 | out: lpRect=0x19eda4) returned 1
[0184.011] SetWindowPos (hWnd=0xb004c, hWndInsertAfter=0xffffffff, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1
[0184.011] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19edbc) returned 0x0
[0184.013] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19edbc) returned 0x0
[0184.013] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
[0184.013] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
[0184.013] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
[0184.013] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0
[0184.013] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
[0184.015] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0184.015] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0184.015] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0184.026] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
[0184.031] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0184.032] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0
[0184.032] GetParent (hWnd=0xb004c) returned 0x0
[0184.032] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0184.032] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0
[0184.032] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19eb2c | out: lpwndpl=0x19eb2c) returned 1
[0184.032] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x47, wParam=0x0, lParam=0x19edbc) returned 0x0
[0184.032] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eadc | out: lpRect=0x19eadc) returned 1
[0184.032] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eadc | out: lpRect=0x19eadc) returned 1
[0184.033] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0184.034] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0184.034] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0184.035] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0184.035] GetWindowLongW (hWnd=0xb004c, nIndex=-16) returned 113770496
[0184.035] GetWindowTextLengthW (hWnd=0xb004c) returned 24
[0184.035] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0184.035] GetSystemMetrics (nIndex=42) returned 0
[0184.035] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19ed20, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0184.035] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19ed20) returned 0x18
[0184.035] GetWindowTextLengthW (hWnd=0xb004c) returned 24
[0184.035] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0184.035] GetSystemMetrics (nIndex=42) returned 0
[0184.035] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19ed20, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0184.036] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19ed20) returned 0x18
[0184.036] GetCursorPos (in: lpPoint=0x233001c | out: lpPoint=0x233001c*(x=1155, y=87)) returned 1
[0184.036] MonitorFromPoint (pt=0x483, dwFlags=0x59) returned 0x10001
[0184.036] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ec70 | out: lpmi=0x19ec70) returned 1
[0184.036] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x110105e1
[0184.036] GetDeviceCaps (hdc=0x110105e1, index=12) returned 32
[0184.036] GetDeviceCaps (hdc=0x110105e1, index=14) returned 1
[0184.036] DeleteDC (hdc=0x110105e1) returned 1
[0184.036] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ecc4 | out: lpmi=0x19ecc4) returned 1
[0184.037] GetWindowLongW (hWnd=0xb004c, nIndex=-16) returned 113770496
[0184.037] GetWindowLongW (hWnd=0xb004c, nIndex=-20) returned 327945
[0184.037] SetWindowLongW (hWnd=0xb004c, nIndex=-16, dwNewLong=46661632) returned 113770496
[0184.037] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7c, wParam=0xfffffff0, lParam=0x19ed9c) returned 0x0
[0184.037] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7d, wParam=0xfffffff0, lParam=0x19ed9c) returned 0x0
[0184.038] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0184.038] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0184.038] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0184.039] SetWindowLongW (hWnd=0xb004c, nIndex=-20, dwNewLong=327681) returned 327945
[0184.039] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7c, wParam=0xffffffec, lParam=0x19ed9c) returned 0x0
[0184.039] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7d, wParam=0xffffffec, lParam=0x19ed9c) returned 0x0
[0184.040] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0184.040] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0184.040] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0184.041] SetWindowPos (hWnd=0xb004c, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1
[0184.041] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19edbc) returned 0x0
[0184.041] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x83, wParam=0x1, lParam=0x19ed94) returned 0x0
[0184.042] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19eb2c | out: lpwndpl=0x19eb2c) returned 1
[0184.042] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x47, wParam=0x0, lParam=0x19edbc) returned 0x0
[0184.042] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eadc | out: lpRect=0x19eadc) returned 1
[0184.042] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eadc | out: lpRect=0x19eadc) returned 1
[0184.043] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0184.043] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0184.043] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0184.044] RedrawWindow (hWnd=0xb004c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0184.044] GetSystemMenu (hWnd=0xb004c, bRevert=0) returned 0xa80307
[0184.044] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19edf0 | out: lpwndpl=0x19edf0) returned 1
[0184.044] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf020, uEnable=0x1) returned 1
[0184.044] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf030, uEnable=0x1) returned 1
[0184.044] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf060, uEnable=0x0) returned 0
[0184.045] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf120, uEnable=0x1) returned 1
[0184.045] EnableMenuItem (hMenu=0xa80307, uIDEnableItem=0xf000, uEnable=0x1) returned 1
[0184.045] GetWindowLongW (hWnd=0xb004c, nIndex=-8) returned 0
[0184.045] IsWindowEnabled (hWnd=0xb004c) returned 1
[0184.045] ShowWindow (hWnd=0xb004c, nCmdShow=5) returned 0
[0184.045] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0184.045] GetCurrentActCtx (in: lphActCtx=0x19e9b0 | out: lphActCtx=0x19e9b0*=0x689cf4) returned 1
[0184.045] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0184.046] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0184.046] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x56000000, X=0, Y=0, nWidth=64, nHeight=64, hWndParent=0xb004c, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x3031c
[0184.046] SetWindowLongW (hWnd=0x3031c, nIndex=-4, dwNewLong=2004528864) returned 76678590
[0184.047] GetWindowLongW (hWnd=0x3031c, nIndex=-4) returned 2004528864
[0184.048] SetWindowLongW (hWnd=0x3031c, nIndex=-4, dwNewLong=76692086) returned 2004528864
[0184.048] GetWindowLongW (hWnd=0x3031c, nIndex=-4) returned 76692086
[0184.048] GetWindowLongW (hWnd=0x3031c, nIndex=-16) returned 1174405120
[0184.048] GetWindowLongW (hWnd=0x3031c, nIndex=-12) returned 0
[0184.048] SetWindowLongW (hWnd=0x3031c, nIndex=-12, dwNewLong=197404) returned 0
[0184.048] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x81, wParam=0x0, lParam=0x19e3d0) returned 0x1
[0184.048] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x83, wParam=0x0, lParam=0x19e3bc) returned 0x0
[0184.049] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x1, wParam=0x0, lParam=0x19e3d0) returned 0x0
[0184.049] GetWindow (hWnd=0x3031c, uCmd=0x3) returned 0x0
[0184.049] GetClientRect (in: hWnd=0x3031c, lpRect=0x19e0fc | out: lpRect=0x19e0fc) returned 1
[0184.049] GetWindowRect (in: hWnd=0x3031c, lpRect=0x19e0fc | out: lpRect=0x19e0fc) returned 1
[0184.049] GetParent (hWnd=0x3031c) returned 0xb004c
[0184.049] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0fc, cPoints=0x2 | out: lpPoints=0x19e0fc) returned -24773109
[0184.050] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x5, wParam=0x0, lParam=0x400040) returned 0x0
[0184.050] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
[0184.050] GetClientRect (in: hWnd=0x3031c, lpRect=0x19e154 | out: lpRect=0x19e154) returned 1
[0184.050] GetWindowRect (in: hWnd=0x3031c, lpRect=0x19e154 | out: lpRect=0x19e154) returned 1
[0184.050] GetParent (hWnd=0x3031c) returned 0xb004c
[0184.050] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e154, cPoints=0x2 | out: lpPoints=0x19e154) returned -24773109
[0184.050] SendMessageW (hWnd=0x3031c, Msg=0x2210, wParam=0x31c0001, lParam=0x3031c) returned 0x0
[0184.050] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x2210, wParam=0x31c0001, lParam=0x3031c) returned 0x0
[0184.050] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0184.051] GetParent (hWnd=0x3031c) returned 0xb004c
[0184.051] GetParent (hWnd=0x801f0) returned 0x601fe
[0184.051] SetParent (hWndChild=0x801f0, hWndNewParent=0xb004c) returned 0x601fe
[0184.051] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0
[0184.052] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x46, wParam=0x0, lParam=0x19e9ac) returned 0x0
[0184.053] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0
[0184.053] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x47, wParam=0x0, lParam=0x19e9ac) returned 0x0
[0184.053] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x3, wParam=0x0, lParam=0x80040) returned 0x0
[0184.053] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e0cc | out: lpRect=0x19e0cc) returned 1
[0184.053] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e0cc | out: lpRect=0x19e0cc) returned 1
[0184.053] GetParent (hWnd=0x801f0) returned 0xb004c
[0184.053] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0cc, cPoints=0x2 | out: lpPoints=0x19e0cc) returned -24773109
[0184.053] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e6b0 | out: lpRect=0x19e6b0) returned 1
[0184.053] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e6b0 | out: lpRect=0x19e6b0) returned 1
[0184.053] GetParent (hWnd=0x801f0) returned 0xb004c
[0184.053] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e6b0, cPoints=0x2 | out: lpPoints=0x19e6b0) returned -24773109
[0184.053] GetParent (hWnd=0x801f0) returned 0xb004c
[0184.054] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0184.054] GetWindow (hWnd=0x801f0, uCmd=0x3) returned 0x0
[0184.054] SetWindowPos (hWnd=0x801f0, hWndInsertAfter=0x3031c, X=0, Y=0, cx=0, cy=0, uFlags=0x3) returned 1
[0184.054] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x46, wParam=0x0, lParam=0x19e954) returned 0x0
[0184.055] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x22, wParam=0x0, lParam=0x0) returned 0x0
[0184.056] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x47, wParam=0x0, lParam=0x19e954) returned 0x0
[0184.056] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e658 | out: lpRect=0x19e658) returned 1
[0184.056] GetWindowRect (in: hWnd=0x801f0, lpRect=0x19e658 | out: lpRect=0x19e658) returned 1
[0184.056] GetParent (hWnd=0x801f0) returned 0xb004c
[0184.056] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e658, cPoints=0x2 | out: lpPoints=0x19e658) returned -24773109
[0184.056] GetParent (hWnd=0x801f0) returned 0xb004c
[0184.056] GetWindow (hWnd=0x801f0, uCmd=0x3) returned 0x3031c
[0184.056] GetWindowThreadProcessId (in: hWnd=0x801f0, lpdwProcessId=0x19ea24 | out: lpdwProcessId=0x19ea24) returned 0xbf8
[0184.056] GetCurrentActCtx (in: lphActCtx=0x19e9b0 | out: lphActCtx=0x19e9b0*=0x689cf4) returned 1
[0184.056] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0184.057] GetClassInfoW (in: hInstance=0x0, lpClassName="BUTTON", lpWndClass=0x233042c | out: lpWndClass=0x233042c) returned 1
[0184.057] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0184.058] CoTaskMemAlloc (cb=0x58) returned 0x7057d0
[0184.058] RegisterClassW (lpWndClass=0x19e868) returned 0xc20c
[0184.058] CoTaskMemFree (pv=0x7057d0)
[0184.058] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0184.058] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.141b42a_r10_ad1", lpWindowName="&Details", dwStyle=0x5601000b, X=8, Y=94, nWidth=100, nHeight=23, hWndParent=0xb004c, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x701de
[0184.058] SetWindowLongW (hWnd=0x701de, nIndex=-4, dwNewLong=1862787184) returned 76692126
[0184.059] GetWindowLongW (hWnd=0x701de, nIndex=-4) returned 1862787184
[0184.059] SetWindowLongW (hWnd=0x701de, nIndex=-4, dwNewLong=76692166) returned 1862787184
[0184.059] GetWindowLongW (hWnd=0x701de, nIndex=-4) returned 76692166
[0184.059] GetWindowLongW (hWnd=0x701de, nIndex=-16) returned 1174470667
[0184.059] GetWindowLongW (hWnd=0x701de, nIndex=-12) returned 0
[0184.059] SetWindowLongW (hWnd=0x701de, nIndex=-12, dwNewLong=459230) returned 0
[0184.059] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x81, wParam=0x0, lParam=0x19e3d0) returned 0x1
[0184.061] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x83, wParam=0x0, lParam=0x19e3bc) returned 0x0
[0184.061] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x1, wParam=0x0, lParam=0x19e3d0) returned 0x0
[0184.063] SendMessageW (hWnd=0x701de, Msg=0x2055, wParam=0x701de, lParam=0x3) returned 0x2
[0184.063] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x0
[0184.063] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0
[0184.063] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
[0184.063] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
[0184.063] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
[0184.063] RedrawWindow (hWnd=0x3031c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0184.063] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
[0184.064] RedrawWindow (hWnd=0x801f0, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0184.064] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x128, wParam=0x30001, lParam=0x0) returned 0x0
[0184.064] RedrawWindow (hWnd=0x701de, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0184.064] RedrawWindow (hWnd=0xb004c, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1
[0184.064] GetWindow (hWnd=0x701de, uCmd=0x3) returned 0x801f0
[0184.064] GetClientRect (in: hWnd=0x701de, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1
[0184.064] GetWindowRect (in: hWnd=0x701de, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1
[0184.064] GetParent (hWnd=0x701de) returned 0xb004c
[0184.064] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0b4, cPoints=0x2 | out: lpPoints=0x19e0b4) returned -24773109
[0184.065] SetWindowTextW (hWnd=0x701de, lpString="&Details") returned 1
[0184.065] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0xc, wParam=0x0, lParam=0x232e2f0) returned 0x1
[0184.066] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0
[0184.066] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x3, wParam=0x0, lParam=0x5e0008) returned 0x0
[0184.066] GetClientRect (in: hWnd=0x701de, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1
[0184.066] GetWindowRect (in: hWnd=0x701de, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1
[0184.066] GetParent (hWnd=0x701de) returned 0xb004c
[0184.066] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e10c, cPoints=0x2 | out: lpPoints=0x19e10c) returned -24773109
[0184.066] SendMessageW (hWnd=0x701de, Msg=0x2210, wParam=0x1de0001, lParam=0x701de) returned 0x0
[0184.066] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x2210, wParam=0x1de0001, lParam=0x701de) returned 0x0
[0184.066] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0184.067] GetParent (hWnd=0x701de) returned 0xb004c
[0184.067] GetCurrentActCtx (in: lphActCtx=0x19e9b0 | out: lphActCtx=0x19e9b0*=0x689cf4) returned 1
[0184.067] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0184.068] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0184.068] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.141b42a_r10_ad1", lpWindowName="&Continue", dwStyle=0x5601000b, X=225, Y=94, nWidth=100, nHeight=23, hWndParent=0xb004c, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x5028a
[0184.069] SetWindowLongW (hWnd=0x5028a, nIndex=-4, dwNewLong=1862787184) returned 76692126
[0184.069] GetWindowLongW (hWnd=0x5028a, nIndex=-4) returned 1862787184
[0184.069] SetWindowLongW (hWnd=0x5028a, nIndex=-4, dwNewLong=76692966) returned 1862787184
[0184.069] GetWindowLongW (hWnd=0x5028a, nIndex=-4) returned 76692966
[0184.069] GetWindowLongW (hWnd=0x5028a, nIndex=-16) returned 1174470667
[0184.070] GetWindowLongW (hWnd=0x5028a, nIndex=-12) returned 0
[0184.070] SetWindowLongW (hWnd=0x5028a, nIndex=-12, dwNewLong=328330) returned 0
[0184.070] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x81, wParam=0x0, lParam=0x19e3d0) returned 0x1
[0184.071] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x83, wParam=0x0, lParam=0x19e3bc) returned 0x0
[0184.071] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x1, wParam=0x0, lParam=0x19e3d0) returned 0x0
[0184.072] SendMessageW (hWnd=0x5028a, Msg=0x2055, wParam=0x5028a, lParam=0x3) returned 0x2
[0184.072] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3
[0184.072] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0
[0184.072] GetWindow (hWnd=0x5028a, uCmd=0x3) returned 0x701de
[0184.072] GetClientRect (in: hWnd=0x5028a, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1
[0184.072] GetWindowRect (in: hWnd=0x5028a, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1
[0184.072] GetParent (hWnd=0x5028a) returned 0xb004c
[0184.072] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0b4, cPoints=0x2 | out: lpPoints=0x19e0b4) returned -24773109
[0184.073] SetWindowTextW (hWnd=0x5028a, lpString="&Continue") returned 1
[0184.073] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0xc, wParam=0x0, lParam=0x232e204) returned 0x1
[0184.073] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0
[0184.074] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x3, wParam=0x0, lParam=0x5e00e1) returned 0x0
[0184.074] GetClientRect (in: hWnd=0x5028a, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1
[0184.074] GetWindowRect (in: hWnd=0x5028a, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1
[0184.074] GetParent (hWnd=0x5028a) returned 0xb004c
[0184.074] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e10c, cPoints=0x2 | out: lpPoints=0x19e10c) returned -24773109
[0184.074] SendMessageW (hWnd=0x5028a, Msg=0x2210, wParam=0x28a0001, lParam=0x5028a) returned 0x0
[0184.074] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x2210, wParam=0x28a0001, lParam=0x5028a) returned 0x0
[0184.074] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0184.074] GetParent (hWnd=0x5028a) returned 0xb004c
[0184.074] GetCurrentActCtx (in: lphActCtx=0x19e9b0 | out: lphActCtx=0x19e9b0*=0x689cf4) returned 1
[0184.075] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0184.075] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0184.076] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.BUTTON.app.0.141b42a_r10_ad1", lpWindowName="&Quit", dwStyle=0x5601000b, X=330, Y=94, nWidth=100, nHeight=23, hWndParent=0xb004c, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x30328
[0184.076] SetWindowLongW (hWnd=0x30328, nIndex=-4, dwNewLong=1862787184) returned 76692126
[0184.076] GetWindowLongW (hWnd=0x30328, nIndex=-4) returned 1862787184
[0184.077] SetWindowLongW (hWnd=0x30328, nIndex=-4, dwNewLong=76692606) returned 1862787184
[0184.077] GetWindowLongW (hWnd=0x30328, nIndex=-4) returned 76692606
[0184.077] GetWindowLongW (hWnd=0x30328, nIndex=-16) returned 1174470667
[0184.077] GetWindowLongW (hWnd=0x30328, nIndex=-12) returned 0
[0184.077] SetWindowLongW (hWnd=0x30328, nIndex=-12, dwNewLong=197416) returned 0
[0184.077] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x81, wParam=0x0, lParam=0x19e3d0) returned 0x1
[0184.078] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x83, wParam=0x0, lParam=0x19e3bc) returned 0x0
[0184.078] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x1, wParam=0x0, lParam=0x19e3d0) returned 0x0
[0184.080] SendMessageW (hWnd=0x30328, Msg=0x2055, wParam=0x30328, lParam=0x3) returned 0x2
[0184.080] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x129, wParam=0x0, lParam=0x0) returned 0x3
[0184.080] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x127, wParam=0x3, lParam=0x0) returned 0x0
[0184.080] GetWindow (hWnd=0x30328, uCmd=0x3) returned 0x5028a
[0184.080] GetClientRect (in: hWnd=0x30328, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1
[0184.080] GetWindowRect (in: hWnd=0x30328, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1
[0184.080] GetParent (hWnd=0x30328) returned 0xb004c
[0184.080] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0b4, cPoints=0x2 | out: lpPoints=0x19e0b4) returned -24773109
[0184.080] SetWindowTextW (hWnd=0x30328, lpString="&Quit") returned 1
[0184.080] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0xc, wParam=0x0, lParam=0x232e258) returned 0x1
[0184.081] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x5, wParam=0x0, lParam=0x170064) returned 0x0
[0184.081] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x3, wParam=0x0, lParam=0x5e014a) returned 0x0
[0184.081] GetClientRect (in: hWnd=0x30328, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1
[0184.081] GetWindowRect (in: hWnd=0x30328, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1
[0184.081] GetParent (hWnd=0x30328) returned 0xb004c
[0184.081] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e10c, cPoints=0x2 | out: lpPoints=0x19e10c) returned -24773109
[0184.082] SendMessageW (hWnd=0x30328, Msg=0x2210, wParam=0x3280001, lParam=0x30328) returned 0x0
[0184.082] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x2210, wParam=0x3280001, lParam=0x30328) returned 0x0
[0184.082] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0184.082] GetParent (hWnd=0x30328) returned 0xb004c
[0184.082] GetCurrentActCtx (in: lphActCtx=0x19e98c | out: lphActCtx=0x19e98c*=0x689cf4) returned 1
[0184.083] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0184.083] GetClassInfoW (in: hInstance=0x0, lpClassName="EDIT", lpWndClass=0x233098c | out: lpWndClass=0x233098c) returned 1
[0184.084] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0184.084] CoTaskMemAlloc (cb=0x54) returned 0x705890
[0184.084] RegisterClassW (lpWndClass=0x19e844) returned 0xc20d
[0184.084] CoTaskMemFree (pv=0x705890)
[0184.085] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0184.085] CreateWindowExW (dwExStyle=0x200, lpClassName="WindowsForms10.EDIT.app.0.141b42a_r10_ad1", lpWindowName="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 192.30.89.67:11344\r\n at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)\r\n at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)\r\n --- End of inner exception stack trace ---\r\n at System.Net.WebClient.UploadValues(Uri address, String method, NameValueCollection data)\r\n at System.Net.WebClient.UploadValues(String address, String method, NameValueCollection data)\r\n at eda2.Form1.GetPublicKey(String url)\r\n at eda2.Form1.StartAction()\r\n at eda2.Form1.Form1_Load(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Form.OnCreateControl()\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.ScrollableControl.WndProc(Message& m)\r\n at System.Windows.Forms.Form.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Form.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll\r\n----------------------------------------\r\nnotepad\r\n Assembly Version: 2.1.0.0\r\n Win32 Version: 2.1.0.0\r\n CodeBase: file:///C:/Users/RDHJ0C~1/AppData/Local/Temp/svhost.exe\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Core\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll\r\n----------------------------------------\r\nSystem.Configuration\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll\r\n----------------------------------------\r\nSystem.Xml\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n", dwStyle=0x563008c4, X=8, Y=125, nWidth=422, nHeight=154, hWndParent=0xb004c, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x60248
[0184.085] SetWindowLongW (hWnd=0x60248, nIndex=-4, dwNewLong=1862779696) returned 76692686
[0184.085] GetWindowLongW (hWnd=0x60248, nIndex=-4) returned 1862779696
[0184.086] SetWindowLongW (hWnd=0x60248, nIndex=-4, dwNewLong=76692726) returned 1862779696
[0184.086] GetWindowLongW (hWnd=0x60248, nIndex=-4) returned 76692726
[0184.086] GetWindowLongW (hWnd=0x60248, nIndex=-16) returned 1177553092
[0184.086] GetWindowLongW (hWnd=0x60248, nIndex=-12) returned 0
[0184.086] SetWindowLongW (hWnd=0x60248, nIndex=-12, dwNewLong=393800) returned 0
[0184.086] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x81, wParam=0x0, lParam=0x19e3b0) returned 0x1
[0184.088] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x83, wParam=0x0, lParam=0x19e39c) returned 0x0
[0184.091] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x1, wParam=0x0, lParam=0x19e3b0) returned 0x1
[0184.175] GetWindow (hWnd=0x60248, uCmd=0x3) returned 0x30328
[0184.175] GetClientRect (in: hWnd=0x60248, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1
[0184.175] GetWindowRect (in: hWnd=0x60248, lpRect=0x19e0b4 | out: lpRect=0x19e0b4) returned 1
[0184.175] GetParent (hWnd=0x60248) returned 0xb004c
[0184.175] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e0b4, cPoints=0x2 | out: lpPoints=0x19e0b4) returned -24773109
[0184.175] GetWindowTextLengthW (hWnd=0xb004c) returned 24
[0184.175] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0184.176] GetSystemMetrics (nIndex=42) returned 0
[0184.176] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19df34, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0184.176] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19df34) returned 0x18
[0184.176] SendMessageW (hWnd=0x60248, Msg=0x30, wParam=0x3a0a09ab, lParam=0x0) returned 0x1
[0184.176] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x30, wParam=0x3a0a09ab, lParam=0x0) returned 0x1
[0184.194] SetWindowTextW (hWnd=0x60248, lpString="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 192.30.89.67:11344\r\n at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)\r\n at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)\r\n --- End of inner exception stack trace ---\r\n at System.Net.WebClient.UploadValues(Uri address, String method, NameValueCollection data)\r\n at System.Net.WebClient.UploadValues(String address, String method, NameValueCollection data)\r\n at eda2.Form1.GetPublicKey(String url)\r\n at eda2.Form1.StartAction()\r\n at eda2.Form1.Form1_Load(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Form.OnCreateControl()\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.ScrollableControl.WndProc(Message& m)\r\n at System.Windows.Forms.Form.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Form.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll\r\n----------------------------------------\r\nnotepad\r\n Assembly Version: 2.1.0.0\r\n Win32 Version: 2.1.0.0\r\n CodeBase: file:///C:/Users/RDHJ0C~1/AppData/Local/Temp/svhost.exe\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Core\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll\r\n----------------------------------------\r\nSystem.Configuration\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll\r\n----------------------------------------\r\nSystem.Xml\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n") returned 1
[0184.194] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xc, wParam=0x0, lParam=0x232ab1c) returned 0x1
[0184.196] GetSystemMetrics (nIndex=5) returned 1
[0184.196] GetSystemMetrics (nIndex=6) returned 1
[0184.196] SendMessageW (hWnd=0x60248, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
[0184.197] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xc5, wParam=0x7fff, lParam=0x0) returned 0x1
[0184.201] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x5, wParam=0x0, lParam=0x850191) returned 0x1
[0184.201] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x3, wParam=0x0, lParam=0x7f000a) returned 0x0
[0184.201] GetClientRect (in: hWnd=0x60248, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1
[0184.201] GetWindowRect (in: hWnd=0x60248, lpRect=0x19e10c | out: lpRect=0x19e10c) returned 1
[0184.201] GetParent (hWnd=0x60248) returned 0xb004c
[0184.201] MapWindowPoints (in: hWndFrom=0x0, hWndTo=0xb004c, lpPoints=0x19e10c, cPoints=0x2 | out: lpPoints=0x19e10c) returned -24773109
[0184.202] SendMessageW (hWnd=0x60248, Msg=0x2210, wParam=0x2480001, lParam=0x60248) returned 0x0
[0184.202] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x2210, wParam=0x2480001, lParam=0x60248) returned 0x0
[0184.202] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0
[0184.202] GetParent (hWnd=0x60248) returned 0xb004c
[0184.202] GetWindowLongW (hWnd=0xb004c, nIndex=-8) returned 0
[0184.202] GetCursorPos (in: lpPoint=0x2330df8 | out: lpPoint=0x2330df8*(x=1155, y=87)) returned 1
[0184.202] MonitorFromPoint (pt=0x106, dwFlags=0x333) returned 0x10001
[0184.203] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e8c0 | out: lpmi=0x19e8c0) returned 1
[0184.203] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x190105e1
[0184.203] GetDeviceCaps (hdc=0x190105e1, index=12) returned 32
[0184.203] GetDeviceCaps (hdc=0x190105e1, index=14) returned 1
[0184.203] DeleteDC (hdc=0x190105e1) returned 1
[0184.203] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19e914 | out: lpmi=0x19e914) returned 1
[0184.203] GetWindowThreadProcessId (in: hWnd=0xb004c, lpdwProcessId=0x19e9c4 | out: lpdwProcessId=0x19e9c4) returned 0xbf8
[0184.203] GetCurrentThreadId () returned 0xbf8
[0184.204] RegisterClipboardFormatW (lpszFormat="WindowsForms12_ThreadCallbackMessage") returned 0xc20e
[0184.204] PostMessageW (hWnd=0xb004c, Msg=0xc20e, wParam=0x0, lParam=0x0) returned 1
[0184.204] GetWindowTextLengthW (hWnd=0xb004c) returned 24
[0184.204] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0184.205] GetSystemMetrics (nIndex=42) returned 0
[0184.205] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19e91c, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0184.205] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19e91c) returned 0x18
[0184.205] GdipImageGetFrameDimensionsCount (image=0x5b3f598, count=0x19e920) returned 0x0
[0184.206] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x6e4520
[0184.206] GdipImageGetFrameDimensionsList (image=0x5b3f598, dimensionIDs=0x6e4520*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0
[0184.208] LocalFree (hMem=0x6e4520) returned 0x0
[0184.398] GdipImageGetFrameDimensionsCount (image=0x5b47f18, count=0x19e914) returned 0x0
[0184.398] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x6e45b0
[0184.398] GdipImageGetFrameDimensionsList (image=0x5b47f18, dimensionIDs=0x6e45b0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), count=0x1) returned 0x0
[0184.398] LocalFree (hMem=0x6e45b0) returned 0x0
[0184.398] SystemParametersInfoW (in: uiAction=0x5f, uiParam=0x0, pvParam=0x19ea5c, fWinIni=0x0 | out: pvParam=0x19ea5c) returned 1
[0184.400] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19ed94) returned 0x0
[0184.413] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0184.414] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0184.414] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0184.414] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0184.415] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19eb20 | out: lpwndpl=0x19eb20) returned 1
[0184.415] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eacc | out: lpRect=0x19eacc) returned 1
[0184.415] GetWindowTextLengthW (hWnd=0xb004c) returned 24
[0184.415] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0184.415] GetSystemMetrics (nIndex=42) returned 0
[0184.415] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19e970, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0184.415] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19e970) returned 0x18
[0184.416] GetClientRect (in: hWnd=0xb004c, lpRect=0x19e9d4 | out: lpRect=0x19e9d4) returned 1
[0184.416] GetCurrentObject (hdc=0x50107d3, type=0x1) returned 0x1b00017
[0184.416] GetCurrentObject (hdc=0x50107d3, type=0x2) returned 0x1900010
[0184.416] GetCurrentObject (hdc=0x50107d3, type=0x7) returned 0x670509b5
[0184.416] GetCurrentObject (hdc=0x50107d3, type=0x6) returned 0x18a0048
[0184.416] SaveDC (hdc=0x50107d3) returned 1
[0184.416] GetNearestColor (hdc=0x50107d3, color=0xf0f0f0) returned 0xf0f0f0
[0184.416] CreateSolidBrush (color=0xf0f0f0) returned 0x101008ec
[0184.416] FillRect (hDC=0x50107d3, lprc=0x19e874, hbr=0x101008ec) returned 1
[0184.416] DeleteObject (ho=0x101008ec) returned 1
[0184.416] RestoreDC (hdc=0x50107d3, nSavedDC=-1) returned 1
[0184.417] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0184.417] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0184.417] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0184.417] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x14, wParam=0x110106ca, lParam=0x0) returned 0x1
[0184.417] GetStockObject (i=5) returned 0x1900015
[0184.418] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0184.418] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x14, wParam=0x50107d3, lParam=0x0) returned 0x1
[0184.418] GetStockObject (i=5) returned 0x1900015
[0184.418] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0184.418] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x14, wParam=0x110106ca, lParam=0x0) returned 0x1
[0184.418] GetStockObject (i=5) returned 0x1900015
[0184.418] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19eb20 | out: lpwndpl=0x19eb20) returned 1
[0184.419] GetClientRect (in: hWnd=0x802a2, lpRect=0x19eacc | out: lpRect=0x19eacc) returned 1
[0184.419] GetWindowTextLengthW (hWnd=0x802a2) returned 7
[0184.419] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0184.419] GetSystemMetrics (nIndex=42) returned 0
[0184.419] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e994, nMaxCount=8 | out: lpString="notepad") returned 7
[0184.419] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e994) returned 0x7
[0184.419] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e9d4 | out: lpRect=0x19e9d4) returned 1
[0184.419] GetCurrentObject (hdc=0x9010784, type=0x1) returned 0x1b00017
[0184.419] GetCurrentObject (hdc=0x9010784, type=0x2) returned 0x1900010
[0184.419] GetCurrentObject (hdc=0x9010784, type=0x7) returned 0x360506d2
[0184.419] GetCurrentObject (hdc=0x9010784, type=0x6) returned 0x18a0048
[0184.419] SaveDC (hdc=0x9010784) returned 1
[0184.419] GetNearestColor (hdc=0x9010784, color=0xf0f0f0) returned 0xf0f0f0
[0184.419] CreateSolidBrush (color=0xf0f0f0) returned 0x111008ec
[0184.419] FillRect (hDC=0x9010784, lprc=0x19e874, hbr=0x111008ec) returned 1
[0184.420] DeleteObject (ho=0x111008ec) returned 1
[0184.420] RestoreDC (hdc=0x9010784, nSavedDC=-1) returned 1
[0184.421] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19eb04 | out: lpwndpl=0x19eb04) returned 1
[0184.421] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x47, wParam=0x0, lParam=0x19ed94) returned 0x0
[0184.421] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eab4 | out: lpRect=0x19eab4) returned 1
[0184.421] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eab4 | out: lpRect=0x19eab4) returned 1
[0184.422] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0184.422] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0184.422] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0184.423] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x5, wParam=0x0, lParam=0x7d01b6) returned 0x0
[0184.423] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x3, wParam=0x0, lParam=0x17b01f5) returned 0x0
[0184.423] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eae4 | out: lpRect=0x19eae4) returned 1
[0184.423] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eae4 | out: lpRect=0x19eae4) returned 1
[0184.424] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1
[0184.424] InvalidateRect (hWnd=0x701de, lpRect=0x0, bErase=0) returned 1
[0184.424] GetFocus () returned 0xb004c
[0184.424] GetFocus () returned 0xb004c
[0184.425] SetFocus (hWnd=0x701de) returned 0xb004c
[0184.425] GetFocus () returned 0x701de
[0184.425] IsChild (hWndParent=0xb004c, hWnd=0x701de) returned 1
[0184.425] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x8, wParam=0x701de, lParam=0x0) returned 0x0
[0184.425] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
[0184.490] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
[0184.491] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0184.491] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x7, wParam=0xb004c, lParam=0x0) returned 0x0
[0184.493] GetStockObject (i=5) returned 0x1900015
[0184.495] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x8
[0184.495] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0xd, wParam=0x9, lParam=0x704cc0) returned 0x8
[0184.497] GetDlgItem (hDlg=0xb004c, nIDDlgItem=459230) returned 0x701de
[0184.497] SendMessageW (hWnd=0x701de, Msg=0x202b, wParam=0x701de, lParam=0x19e824) returned 0x0
[0184.497] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x202b, wParam=0x701de, lParam=0x19e824) returned 0x0
[0184.497] InvalidateRect (hWnd=0x701de, lpRect=0x0, bErase=0) returned 1
[0184.497] GetFocus () returned 0x701de
[0184.498] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.498] IsWindowUnicode (hWnd=0x802a2) returned 1
[0184.498] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.501] TranslateMessage (lpMsg=0x19ee84) returned 0
[0184.501] DispatchMessageW (lpMsg=0x19ee84) returned 0x0
[0184.502] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x46, wParam=0x0, lParam=0x19ec24) returned 0x0
[0184.502] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x83, wParam=0x1, lParam=0x19ebfc) returned 0x0
[0184.546] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0184.549] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19e9b0 | out: lpwndpl=0x19e9b0) returned 1
[0184.549] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e95c | out: lpRect=0x19e95c) returned 1
[0184.549] GetWindowTextLengthW (hWnd=0x802a2) returned 7
[0184.549] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0184.549] GetSystemMetrics (nIndex=42) returned 0
[0184.549] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e824, nMaxCount=8 | out: lpString="notepad") returned 7
[0184.549] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e824) returned 0x7
[0184.549] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e864 | out: lpRect=0x19e864) returned 1
[0184.549] GetCurrentObject (hdc=0x9010784, type=0x1) returned 0x1b00017
[0184.549] GetCurrentObject (hdc=0x9010784, type=0x2) returned 0x1900010
[0184.550] GetCurrentObject (hdc=0x9010784, type=0x7) returned 0x360506d2
[0184.550] GetCurrentObject (hdc=0x9010784, type=0x6) returned 0x18a0048
[0184.550] SaveDC (hdc=0x9010784) returned 1
[0184.550] GetNearestColor (hdc=0x9010784, color=0xf0f0f0) returned 0xf0f0f0
[0184.550] CreateSolidBrush (color=0xf0f0f0) returned 0x121008ec
[0184.550] FillRect (hDC=0x9010784, lprc=0x19e704, hbr=0x121008ec) returned 1
[0184.550] DeleteObject (ho=0x121008ec) returned 1
[0184.556] RestoreDC (hdc=0x9010784, nSavedDC=-1) returned 1
[0184.556] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19e994 | out: lpwndpl=0x19e994) returned 1
[0184.557] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x47, wParam=0x0, lParam=0x19ec24) returned 0x0
[0184.557] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e944 | out: lpRect=0x19e944) returned 1
[0184.557] GetWindowRect (in: hWnd=0x802a2, lpRect=0x19e944 | out: lpRect=0x19e944) returned 1
[0184.559] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x83, wParam=0x1, lParam=0x19e774) returned 0x0
[0184.560] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0
[0184.562] GetWindowPlacement (in: hWnd=0x802a2, lpwndpl=0x19e528 | out: lpwndpl=0x19e528) returned 1
[0184.562] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e4d4 | out: lpRect=0x19e4d4) returned 1
[0184.562] GetWindowTextLengthW (hWnd=0x802a2) returned 7
[0184.562] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0184.562] GetSystemMetrics (nIndex=42) returned 0
[0184.562] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19e39c, nMaxCount=8 | out: lpString="notepad") returned 7
[0184.562] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19e39c) returned 0x7
[0184.562] GetClientRect (in: hWnd=0x802a2, lpRect=0x19e3dc | out: lpRect=0x19e3dc) returned 1
[0184.562] GetCurrentObject (hdc=0x50107d3, type=0x1) returned 0x1b00017
[0184.562] GetCurrentObject (hdc=0x50107d3, type=0x2) returned 0x1900010
[0184.562] GetCurrentObject (hdc=0x50107d3, type=0x7) returned 0x360506d2
[0184.562] GetCurrentObject (hdc=0x50107d3, type=0x6) returned 0x18a0048
[0184.562] SaveDC (hdc=0x50107d3) returned 1
[0184.562] GetNearestColor (hdc=0x50107d3, color=0xf0f0f0) returned 0xf0f0f0
[0184.562] CreateSolidBrush (color=0xf0f0f0) returned 0x131008ec
[0184.562] FillRect (hDC=0x50107d3, lprc=0x19e27c, hbr=0x131008ec) returned 1
[0184.593] DeleteObject (ho=0x131008ec) returned 1
[0184.593] RestoreDC (hdc=0x50107d3, nSavedDC=-1) returned 1
[0184.594] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0
[0184.594] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.594] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x60) returned 0x0
[0184.596] IsWindowUnicode (hWnd=0x7032c) returned 1
[0184.596] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.596] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x60) returned 0x0
[0184.597] TranslateMessage (lpMsg=0x19ee84) returned 0
[0184.597] DispatchMessageW (lpMsg=0x19ee84) returned 0x0
[0184.597] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0
[0184.597] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.597] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x60) returned 0x0
[0184.598] IsWindowUnicode (hWnd=0xb004c) returned 1
[0184.598] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.598] TranslateMessage (lpMsg=0x19ee84) returned 0
[0184.598] DispatchMessageW (lpMsg=0x19ee84) returned 0x0
[0184.606] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0
[0184.606] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.606] IsWindowUnicode (hWnd=0xb004c) returned 1
[0184.606] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.606] TranslateMessage (lpMsg=0x19ee84) returned 0
[0184.607] DispatchMessageW (lpMsg=0x19ee84) returned 0x0
[0184.607] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.608] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1
[0184.609] IsWindowUnicode (hWnd=0x5028a) returned 1
[0184.609] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.609] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1
[0184.611] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003
[0184.611] SetCursor (hCursor=0x10003) returned 0x10007
[0184.611] TranslateMessage (lpMsg=0x19ee84) returned 0
[0184.612] DispatchMessageW (lpMsg=0x19ee84) returned 0x0
[0184.637] _TrackMouseEvent (in: lpEventTrack=0x2332200 | out: lpEventTrack=0x2332200) returned 1
[0184.637] SendMessageW (hWnd=0x5028a, Msg=0xc1d1, wParam=0x0, lParam=0x0) returned 0x0
[0184.637] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0xc1d1, wParam=0x0, lParam=0x0) returned 0x0
[0184.768] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1
[0184.769] GetKeyState (nVirtKey=1) returned 0
[0184.769] GetKeyState (nVirtKey=2) returned 0
[0184.769] GetKeyState (nVirtKey=4) returned 0
[0184.769] GetKeyState (nVirtKey=5) returned 0
[0184.769] GetKeyState (nVirtKey=6) returned 0
[0184.769] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.769] IsWindowUnicode (hWnd=0xb004c) returned 1
[0184.769] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.769] TranslateMessage (lpMsg=0x19ee84) returned 0
[0184.769] DispatchMessageW (lpMsg=0x19ee84) returned 0x0
[0184.770] BeginPaint (in: hWnd=0xb004c, lpPaint=0x19e94c | out: lpPaint=0x19e94c) returned 0x9010784
[0184.771] GdipCreateHalftonePalette () returned 0x6e0806d0
[0184.772] SelectPalette (hdc=0x9010784, hPal=0x6e0806d0, bForceBkgd=1) returned 0x188000b
[0184.772] GetWindowTextLengthW (hWnd=0xb004c) returned 24
[0184.772] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0184.772] GetSystemMetrics (nIndex=42) returned 0
[0184.772] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19e8c0, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0184.772] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19e8c0) returned 0x18
[0184.772] SelectPalette (hdc=0x9010784, hPal=0x188000b, bForceBkgd=0) returned 0x6e0806d0
[0184.773] EndPaint (hWnd=0xb004c, lpPaint=0x19e948) returned 1
[0184.773] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.773] IsWindowUnicode (hWnd=0x3031c) returned 1
[0184.773] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.773] TranslateMessage (lpMsg=0x19ee84) returned 0
[0184.773] DispatchMessageW (lpMsg=0x19ee84) returned 0x0
[0184.773] BeginPaint (in: hWnd=0x3031c, lpPaint=0x19e96c | out: lpPaint=0x19e96c) returned 0x50107d3
[0184.774] SelectPalette (hdc=0x50107d3, hPal=0x6e0806d0, bForceBkgd=1) returned 0x188000b
[0184.776] CreateCompatibleDC (hdc=0x50107d3) returned 0x770109d5
[0184.776] GetObjectType (h=0x50107d3) returned 0x3
[0184.776] CreateCompatibleBitmap (hdc=0x50107d3, cx=1, cy=1) returned 0x480509ad
[0184.777] GetDIBits (in: hdc=0x50107d3, hbm=0x480509ad, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x19e45c, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e45c) returned 1
[0184.777] GetDIBits (in: hdc=0x50107d3, hbm=0x480509ad, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x19e45c, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e45c) returned 1
[0184.777] DeleteObject (ho=0x480509ad) returned 1
[0184.777] CreateDIBSection (in: hdc=0x50107d3, lpbmi=0x19e4ac, usage=0x0, ppvBits=0x19e9a0, hSection=0x0, offset=0x0 | out: ppvBits=0x19e9a0) returned 0x3e0506d6
[0184.778] SelectObject (hdc=0x770109d5, h=0x3e0506d6) returned 0x185000f
[0184.778] GdipCreateFromHDC (hdc=0x770109d5, graphics=0x19e984) returned 0x0
[0184.779] GdipTranslateWorldTransform (graphics=0x5b3f268, dx=0x0, dy=0x0, order=0x0) returned 0x0
[0184.779] GdipSetClipRectI (graphics=0x5b3f268, x=0, y=0, width=64, height=64, combineMode=0x0) returned 0x0
[0184.783] GdipCreateMatrix (matrix=0x19e9cc) returned 0x0
[0184.783] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b46b80) returned 0x0
[0184.783] GdipIsMatrixIdentity (matrix=0x5b46b80, result=0x19e9e4) returned 0x0
[0184.783] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee050
[0184.784] GdipGetMatrixElements (matrix=0x5b46b80, matrixOut=0x6ee050) returned 0x0
[0184.784] LocalFree (hMem=0x6ee050) returned 0x0
[0184.785] GdipDeleteMatrix (matrix=0x5b46b80) returned 0x0
[0184.785] GdipCreateRegion (region=0x19e9cc) returned 0x0
[0184.785] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0
[0184.786] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e9d8) returned 0x0
[0184.786] GdipSaveGraphics (graphics=0x5b3f268, state=0x19ea04) returned 0x0
[0184.786] GetWindowTextLengthW (hWnd=0x3031c) returned 0
[0184.786] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0184.786] GetSystemMetrics (nIndex=42) returned 0
[0184.786] GetWindowTextW (in: hWnd=0x3031c, lpString=0x19e91c, nMaxCount=1 | out: lpString="") returned 0
[0184.786] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xd, wParam=0x1, lParam=0x19e91c) returned 0x0
[0184.787] GetClientRect (in: hWnd=0x3031c, lpRect=0x19e9cc | out: lpRect=0x19e9cc) returned 1
[0184.787] GdipCreateRegion (region=0x19e820) returned 0x0
[0184.787] GdipGetClip (graphics=0x5b3f268, region=0x5b46bf0) returned 0x0
[0184.787] GdipCreateMatrix (matrix=0x19e820) returned 0x0
[0184.787] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b40a08) returned 0x0
[0184.788] GdipIsMatrixIdentity (matrix=0x5b40a08, result=0x19e838) returned 0x0
[0184.788] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee0f8
[0184.788] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6ee0f8) returned 0x0
[0184.788] LocalFree (hMem=0x6ee0f8) returned 0x0
[0184.790] GdipCombineRegionRegion (region=0x5b46bf0, region2=0x5b48418, combineMode=0x1) returned 0x0
[0184.790] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee088
[0184.790] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6ee088) returned 0x0
[0184.790] LocalFree (hMem=0x6ee088) returned 0x0
[0184.791] GdipDeleteMatrix (matrix=0x5b40a08) returned 0x0
[0184.791] GdipIsInfiniteRegion (region=0x5b46bf0, graphics=0x5b3f268, result=0x19e860) returned 0x0
[0184.791] GdipIsInfiniteRegion (region=0x5b46bf0, graphics=0x5b3f268, result=0x19e850) returned 0x0
[0184.791] GdipGetRegionHRgn (region=0x5b46bf0, graphics=0x5b3f268, hRgn=0x19e850) returned 0x0
[0184.793] GdipDeleteRegion (region=0x5b46bf0) returned 0x0
[0184.793] GdipGetDC (graphics=0x5b3f268, hdc=0x19e868) returned 0x0
[0184.793] GetCurrentObject (hdc=0x770109d5, type=0x1) returned 0x1b00017
[0184.793] GetCurrentObject (hdc=0x770109d5, type=0x2) returned 0x1900010
[0184.793] GetCurrentObject (hdc=0x770109d5, type=0x7) returned 0x3e0506d6
[0184.793] GetCurrentObject (hdc=0x770109d5, type=0x6) returned 0x18a0048
[0184.793] SaveDC (hdc=0x770109d5) returned 1
[0184.794] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x1f04087b
[0184.794] GetClipRgn (hdc=0x770109d5, hrgn=0x1f04087b) returned 0
[0184.794] SelectClipRgn (hdc=0x770109d5, hrgn=0x5c0406cc) returned 2
[0184.794] DeleteObject (ho=0x1f04087b) returned 1
[0184.794] DeleteObject (ho=0x5c0406cc) returned 1
[0184.796] OffsetViewportOrgEx (in: hdc=0x770109d5, x=0, y=0, lppt=0x23338e4 | out: lppt=0x23338e4) returned 1
[0184.797] GetNearestColor (hdc=0x770109d5, color=0xf0f0f0) returned 0xf0f0f0
[0184.798] CreateSolidBrush (color=0xf0f0f0) returned 0x141008ec
[0184.798] FillRect (hDC=0x770109d5, lprc=0x19e86c, hbr=0x141008ec) returned 1
[0184.798] DeleteObject (ho=0x141008ec) returned 1
[0184.798] RestoreDC (hdc=0x770109d5, nSavedDC=-1) returned 1
[0184.799] GdipReleaseDC (graphics=0x5b3f268, hdc=0x770109d5) returned 0x0
[0184.818] GdipRestoreGraphics (graphics=0x5b3f268, state=0xfdb40dbd) returned 0x0
[0184.818] GdipDeleteRegion (region=0x5b48418) returned 0x0
[0184.819] GetWindowTextLengthW (hWnd=0x3031c) returned 0
[0184.819] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0184.819] GetSystemMetrics (nIndex=42) returned 0
[0184.819] GetWindowTextW (in: hWnd=0x3031c, lpString=0x19e91c, nMaxCount=1 | out: lpString="") returned 0
[0184.819] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xd, wParam=0x1, lParam=0x19e91c) returned 0x0
[0184.819] GdipGetImageWidth (image=0x5b3f598, width=0x19e8b4) returned 0x0
[0184.819] GdipGetImageHeight (image=0x5b3f598, height=0x19e8b4) returned 0x0
[0184.820] GdipGetImageWidth (image=0x5b3f598, width=0x19e8a0) returned 0x0
[0184.820] GdipGetImageHeight (image=0x5b3f598, height=0x19e8a0) returned 0x0
[0184.820] GdipDrawImageRectI (graphics=0x5b3f268, image=0x5b3f598, x=16, y=16, width=32, height=32) returned 0x0
[0184.821] GdipGetDC (graphics=0x5b3f268, hdc=0x19e9c4) returned 0x0
[0184.822] BitBlt (hdc=0x50107d3, x=0, y=0, cx=64, cy=64, hdcSrc=0x770109d5, x1=0, y1=0, rop=0xcc0020) returned 1
[0184.822] GdipReleaseDC (graphics=0x5b3f268, hdc=0x770109d5) returned 0x0
[0184.822] SelectPalette (hdc=0x50107d3, hPal=0x188000b, bForceBkgd=0) returned 0x6e0806d0
[0184.823] SelectObject (hdc=0x770109d5, h=0x185000f) returned 0x3e0506d6
[0184.823] DeleteDC (hdc=0x770109d5) returned 1
[0184.823] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0
[0184.823] EndPaint (hWnd=0x3031c, lpPaint=0x19e968) returned 1
[0184.823] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.824] IsWindowUnicode (hWnd=0x801f0) returned 1
[0184.824] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.824] TranslateMessage (lpMsg=0x19ee84) returned 0
[0184.824] DispatchMessageW (lpMsg=0x19ee84) returned 0x0
[0184.824] BeginPaint (in: hWnd=0x801f0, lpPaint=0x19e930 | out: lpPaint=0x19e930) returned 0xd001053c
[0184.824] SelectPalette (hdc=0xd001053c, hPal=0x6e0806d0, bForceBkgd=1) returned 0x188000b
[0184.824] CreateCompatibleDC (hdc=0xd001053c) returned 0x790109d5
[0184.825] GetObjectType (h=0xd001053c) returned 0x3
[0184.825] CreateCompatibleBitmap (hdc=0xd001053c, cx=1, cy=1) returned 0x430506dd
[0184.825] GetDIBits (in: hdc=0xd001053c, hbm=0x430506dd, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x19e3e0, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e3e0) returned 1
[0184.825] GetDIBits (in: hdc=0xd001053c, hbm=0x430506dd, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x19e3e0, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e3e0) returned 1
[0184.825] DeleteObject (ho=0x430506dd) returned 1
[0184.825] CreateDIBSection (in: hdc=0xd001053c, lpbmi=0x19e430, usage=0x0, ppvBits=0x19e924, hSection=0x0, offset=0x0 | out: ppvBits=0x19e924) returned 0x660506c7
[0184.825] SelectObject (hdc=0x790109d5, h=0x660506c7) returned 0x185000f
[0184.826] GdipCreateFromHDC (hdc=0x790109d5, graphics=0x19e908) returned 0x0
[0184.826] GdipTranslateWorldTransform (graphics=0x5b3f268, dx=0x0, dy=0x0, order=0x0) returned 0x0
[0184.826] GdipSetClipRectI (graphics=0x5b3f268, x=0, y=0, width=354, height=68, combineMode=0x0) returned 0x0
[0184.826] GdipCreateMatrix (matrix=0x19e990) returned 0x0
[0184.826] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b46b80) returned 0x0
[0184.826] GdipIsMatrixIdentity (matrix=0x5b46b80, result=0x19e9a8) returned 0x0
[0184.826] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ede58
[0184.826] GdipGetMatrixElements (matrix=0x5b46b80, matrixOut=0x6ede58) returned 0x0
[0184.827] LocalFree (hMem=0x6ede58) returned 0x0
[0184.827] GdipDeleteMatrix (matrix=0x5b46b80) returned 0x0
[0184.827] GdipCreateRegion (region=0x19e990) returned 0x0
[0184.827] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0
[0184.836] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e99c) returned 0x0
[0184.836] GdipSaveGraphics (graphics=0x5b3f268, state=0x19e9c8) returned 0x0
[0184.836] GetWindowTextLengthW (hWnd=0x801f0) returned 242
[0184.836] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xf2
[0184.837] GetSystemMetrics (nIndex=42) returned 0
[0184.837] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19e6fc, nMaxCount=243 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.") returned 242
[0184.837] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0xf3, lParam=0x19e6fc) returned 0xf2
[0184.837] GetClientRect (in: hWnd=0x801f0, lpRect=0x19e990 | out: lpRect=0x19e990) returned 1
[0184.837] GdipCreateRegion (region=0x19e7e4) returned 0x0
[0184.837] GdipGetClip (graphics=0x5b3f268, region=0x5b46bf0) returned 0x0
[0184.837] GdipCreateMatrix (matrix=0x19e7e4) returned 0x0
[0184.837] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b40a08) returned 0x0
[0184.837] GdipIsMatrixIdentity (matrix=0x5b40a08, result=0x19e7fc) returned 0x0
[0184.837] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6edec8
[0184.837] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6edec8) returned 0x0
[0184.838] LocalFree (hMem=0x6edec8) returned 0x0
[0184.838] GdipCombineRegionRegion (region=0x5b46bf0, region2=0x5b48418, combineMode=0x1) returned 0x0
[0184.838] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6edf00
[0184.838] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6edf00) returned 0x0
[0184.838] LocalFree (hMem=0x6edf00) returned 0x0
[0184.838] GdipDeleteMatrix (matrix=0x5b40a08) returned 0x0
[0184.838] GdipIsInfiniteRegion (region=0x5b46bf0, graphics=0x5b3f268, result=0x19e824) returned 0x0
[0184.838] GdipIsInfiniteRegion (region=0x5b46bf0, graphics=0x5b3f268, result=0x19e814) returned 0x0
[0184.839] GdipGetRegionHRgn (region=0x5b46bf0, graphics=0x5b3f268, hRgn=0x19e814) returned 0x0
[0184.839] GdipDeleteRegion (region=0x5b46bf0) returned 0x0
[0184.839] GdipGetDC (graphics=0x5b3f268, hdc=0x19e82c) returned 0x0
[0184.839] GetCurrentObject (hdc=0x790109d5, type=0x1) returned 0x1b00017
[0184.839] GetCurrentObject (hdc=0x790109d5, type=0x2) returned 0x1900010
[0184.839] GetCurrentObject (hdc=0x790109d5, type=0x7) returned 0x660506c7
[0184.839] GetCurrentObject (hdc=0x790109d5, type=0x6) returned 0x18a0048
[0184.839] SaveDC (hdc=0x790109d5) returned 1
[0184.839] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x5d0406cc
[0184.839] GetClipRgn (hdc=0x790109d5, hrgn=0x5d0406cc) returned 0
[0184.839] SelectClipRgn (hdc=0x790109d5, hrgn=0x2004087b) returned 2
[0184.840] DeleteObject (ho=0x5d0406cc) returned 1
[0184.840] DeleteObject (ho=0x2004087b) returned 1
[0184.840] OffsetViewportOrgEx (in: hdc=0x790109d5, x=0, y=0, lppt=0x23352e8 | out: lppt=0x23352e8) returned 1
[0184.840] GetNearestColor (hdc=0x790109d5, color=0xf0f0f0) returned 0xf0f0f0
[0184.840] CreateSolidBrush (color=0xf0f0f0) returned 0x151008ec
[0184.840] FillRect (hDC=0x790109d5, lprc=0x19e830, hbr=0x151008ec) returned 1
[0184.841] DeleteObject (ho=0x151008ec) returned 1
[0184.842] RestoreDC (hdc=0x790109d5, nSavedDC=-1) returned 1
[0184.842] GdipReleaseDC (graphics=0x5b3f268, hdc=0x790109d5) returned 0x0
[0184.842] GdipRestoreGraphics (graphics=0x5b3f268, state=0xfdb20dbd) returned 0x0
[0184.842] GdipDeleteRegion (region=0x5b48418) returned 0x0
[0184.842] GetWindowTextLengthW (hWnd=0x801f0) returned 242
[0184.842] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xf2
[0184.842] GetSystemMetrics (nIndex=42) returned 0
[0184.842] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19e6fc, nMaxCount=243 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.") returned 242
[0184.842] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0xf3, lParam=0x19e6fc) returned 0xf2
[0184.842] GdipGetDC (graphics=0x5b3f268, hdc=0x19e84c) returned 0x0
[0184.842] GetCurrentObject (hdc=0x790109d5, type=0x1) returned 0x1b00017
[0184.842] GetCurrentObject (hdc=0x790109d5, type=0x2) returned 0x1900010
[0184.842] GetCurrentObject (hdc=0x790109d5, type=0x7) returned 0x660506c7
[0184.842] GetCurrentObject (hdc=0x790109d5, type=0x6) returned 0x18a0048
[0184.843] SaveDC (hdc=0x790109d5) returned 1
[0184.843] GetNearestColor (hdc=0x790109d5, color=0x0) returned 0x0
[0184.843] RestoreDC (hdc=0x790109d5, nSavedDC=-1) returned 1
[0184.843] GdipReleaseDC (graphics=0x5b3f268, hdc=0x790109d5) returned 0x0
[0184.843] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x6efe0000
[0184.844] AdjustWindowRectEx (in: lpRect=0x19e770, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19e770) returned 1
[0184.856] GdipGetFamilyName (in: family=0x5b350a0, name=0x19e660, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0
[0184.858] CreateCompatibleDC (hdc=0x0) returned 0x640106b0
[0184.858] GetCurrentObject (hdc=0x640106b0, type=0x1) returned 0x1b00017
[0184.858] GetCurrentObject (hdc=0x640106b0, type=0x2) returned 0x1900010
[0184.858] GetCurrentObject (hdc=0x640106b0, type=0x7) returned 0x185000f
[0184.858] GetCurrentObject (hdc=0x640106b0, type=0x6) returned 0x18a0048
[0184.858] SaveDC (hdc=0x640106b0) returned 1
[0184.858] GetDeviceCaps (hdc=0x640106b0, index=90) returned 96
[0184.859] CoTaskMemAlloc (cb=0x5c) returned 0x6eb2d8
[0184.859] CreateFontIndirectW (lplf=0x6eb2d8) returned 0x7e0a09e9
[0184.860] CoTaskMemFree (pv=0x6eb2d8)
[0184.860] GetObjectW (in: h=0x7e0a09e9, c=92, pv=0x19e638 | out: pv=0x19e638) returned 92
[0184.860] GetCurrentObject (hdc=0x640106b0, type=0x6) returned 0x18a0048
[0184.861] GetObjectW (in: h=0x18a0048, c=92, pv=0x19e590 | out: pv=0x19e590) returned 92
[0184.861] SelectObject (hdc=0x640106b0, h=0x7e0a09e9) returned 0x18a0048
[0184.861] GetMapMode (hdc=0x640106b0) returned 1
[0184.862] GetTextMetricsW (in: hdc=0x640106b0, lptm=0x19e644 | out: lptm=0x19e644) returned 1
[0184.863] DrawTextExW (in: hdc=0x640106b0, lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.", cchText=242, lprc=0x19e758, format=0x102400, lpdtp=0x2335fcc | out: lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.", lprc=0x19e758) returned 39
[0184.864] GdipGetTextRenderingHint (graphics=0x5b3f268, mode=0x19e7ec) returned 0x0
[0184.865] GdipGetDC (graphics=0x5b3f268, hdc=0x19e7d8) returned 0x0
[0184.865] GetCurrentObject (hdc=0x790109d5, type=0x1) returned 0x1b00017
[0184.865] GetCurrentObject (hdc=0x790109d5, type=0x2) returned 0x1900010
[0184.865] GetCurrentObject (hdc=0x790109d5, type=0x7) returned 0x660506c7
[0184.865] GetCurrentObject (hdc=0x790109d5, type=0x6) returned 0x18a0048
[0184.865] SaveDC (hdc=0x790109d5) returned 1
[0184.866] GetTextAlign (hdc=0x790109d5) returned 0x0
[0184.866] GetTextColor (hdc=0x790109d5) returned 0x0
[0184.866] GetCurrentObject (hdc=0x790109d5, type=0x6) returned 0x18a0048
[0184.866] GetObjectW (in: h=0x18a0048, c=92, pv=0x19e4e0 | out: pv=0x19e4e0) returned 92
[0184.867] SelectObject (hdc=0x790109d5, h=0x7e0a09e9) returned 0x18a0048
[0184.867] GetBkMode (hdc=0x790109d5) returned 2
[0184.867] SetBkMode (hdc=0x790109d5, mode=1) returned 2
[0184.867] DrawTextExW (in: hdc=0x790109d5, lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.", cchText=242, lprc=0x19e76c, format=0x102010, lpdtp=0x2336200 | out: lpchText="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.", lprc=0x19e76c) returned 65
[0184.873] RestoreDC (hdc=0x790109d5, nSavedDC=-1) returned 1
[0184.874] GdipReleaseDC (graphics=0x5b3f268, hdc=0x790109d5) returned 0x0
[0184.874] GdipGetDC (graphics=0x5b3f268, hdc=0x19e988) returned 0x0
[0184.874] BitBlt (hdc=0xd001053c, x=0, y=0, cx=354, cy=68, hdcSrc=0x790109d5, x1=0, y1=0, rop=0xcc0020) returned 1
[0184.874] GdipReleaseDC (graphics=0x5b3f268, hdc=0x790109d5) returned 0x0
[0184.874] SelectPalette (hdc=0xd001053c, hPal=0x188000b, bForceBkgd=0) returned 0x6e0806d0
[0184.874] SelectObject (hdc=0x790109d5, h=0x185000f) returned 0x660506c7
[0184.874] DeleteDC (hdc=0x790109d5) returned 1
[0184.874] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0
[0184.874] DeleteObject (ho=0x660506c7) returned 1
[0184.875] EndPaint (hWnd=0x801f0, lpPaint=0x19e92c) returned 1
[0184.875] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.876] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x86, wParam=0x1, lParam=0x0) returned 0x1
[0184.885] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0184.885] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0184.885] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0184.888] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19ed5c) returned 0x0
[0184.888] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1
[0184.888] IsWindowUnicode (hWnd=0x5028a) returned 1
[0184.888] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.888] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1
[0184.889] GetDlgItem (hDlg=0xb004c, nIDDlgItem=0) returned 0x0
[0184.889] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x210, wParam=0x201, lParam=0x6400fb) returned 0x0
[0184.889] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x21, wParam=0xb004c, lParam=0x2010001) returned 0x1
[0184.889] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x21, wParam=0xb004c, lParam=0x2010001) returned 0x1
[0184.889] SetCursor (hCursor=0x10003) returned 0x10003
[0184.889] TranslateMessage (lpMsg=0x19ee84) returned 0
[0184.889] DispatchMessageW (lpMsg=0x19ee84) returned 0x0
[0184.889] GetKeyState (nVirtKey=1) returned -127
[0184.890] GetKeyState (nVirtKey=2) returned 0
[0184.890] GetKeyState (nVirtKey=4) returned 0
[0184.890] GetKeyState (nVirtKey=5) returned 0
[0184.890] GetKeyState (nVirtKey=6) returned 0
[0184.890] IsWindowVisible (hWnd=0x5028a) returned 1
[0184.890] IsWindowEnabled (hWnd=0x5028a) returned 1
[0184.890] SetFocus (hWnd=0x5028a) returned 0x701de
[0184.891] GetFocus () returned 0x5028a
[0184.891] IsChild (hWndParent=0xb004c, hWnd=0x5028a) returned 1
[0184.891] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x8, wParam=0x5028a, lParam=0x0) returned 0x0
[0184.891] GetCapture () returned 0x0
[0184.891] InvalidateRect (hWnd=0x701de, lpRect=0x0, bErase=0) returned 1
[0184.891] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
[0184.892] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0
[0184.894] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0184.894] InvalidateRect (hWnd=0x701de, lpRect=0x0, bErase=0) returned 1
[0184.894] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1
[0184.894] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x7, wParam=0x701de, lParam=0x0) returned 0x0
[0184.895] GetStockObject (i=5) returned 0x1900015
[0184.895] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x9
[0184.895] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0xd, wParam=0xa, lParam=0x704f20) returned 0x9
[0184.895] GetDlgItem (hDlg=0xb004c, nIDDlgItem=328330) returned 0x5028a
[0184.895] SendMessageW (hWnd=0x5028a, Msg=0x202b, wParam=0x5028a, lParam=0x19e564) returned 0x0
[0184.895] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x202b, wParam=0x5028a, lParam=0x19e564) returned 0x0
[0184.895] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1
[0184.898] GetFocus () returned 0x5028a
[0184.898] GetFocus () returned 0x5028a
[0184.898] GetFocus () returned 0x5028a
[0184.898] GetKeyState (nVirtKey=1) returned -127
[0184.898] GetKeyState (nVirtKey=2) returned 0
[0184.898] GetKeyState (nVirtKey=4) returned 0
[0184.898] GetKeyState (nVirtKey=5) returned 0
[0184.898] GetKeyState (nVirtKey=6) returned 0
[0184.898] GetCapture () returned 0x0
[0184.899] SetCapture (hWnd=0x5028a) returned 0x0
[0184.899] GetKeyState (nVirtKey=1) returned -127
[0184.899] GetKeyState (nVirtKey=2) returned 0
[0184.899] GetKeyState (nVirtKey=4) returned 0
[0184.899] GetKeyState (nVirtKey=5) returned 0
[0184.899] GetKeyState (nVirtKey=6) returned 0
[0184.899] NotifyWinEvent (event=0x800a, hwnd=0x5028a, idObject=-4, idChild=0)
[0184.899] InvalidateRect (hWnd=0x5028a, lpRect=0x19eaf4, bErase=0) returned 1
[0184.900] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.900] IsWindowUnicode (hWnd=0x5028a) returned 1
[0184.900] GetMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19ee84) returned 1
[0184.901] TranslateMessage (lpMsg=0x19ee84) returned 0
[0184.901] DispatchMessageW (lpMsg=0x19ee84) returned 0x0
[0184.902] MapWindowPoints (in: hWndFrom=0x5028a, hWndTo=0x0, lpPoints=0x2336330, cPoints=0x1 | out: lpPoints=0x2336330) returned 30999254
[0185.073] NotifyWinEvent (event=0x800a, hwnd=0x5028a, idObject=-4, idChild=0)
[0185.073] InvalidateRect (hWnd=0x5028a, lpRect=0x19ea98, bErase=0) returned 1
[0185.073] UpdateWindow (hWnd=0x5028a) returned 1
[0185.074] BeginPaint (in: hWnd=0x5028a, lpPaint=0x19e604 | out: lpPaint=0x19e604) returned 0x110106ca
[0185.074] SelectPalette (hdc=0x110106ca, hPal=0x6e0806d0, bForceBkgd=1) returned 0x188000b
[0185.074] CreateCompatibleDC (hdc=0x110106ca) returned 0x810109d5
[0185.074] DeleteObject (ho=0x3e0506d6) returned 1
[0185.074] GetObjectType (h=0x110106ca) returned 0x3
[0185.074] CreateCompatibleBitmap (hdc=0x110106ca, cx=1, cy=1) returned 0x4a0509ad
[0185.074] GetDIBits (in: hdc=0x110106ca, hbm=0x4a0509ad, start=0x0, cLines=0x0, lpvBits=0x0, lpbmi=0x19e0f4, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e0f4) returned 1
[0185.074] GetDIBits (in: hdc=0x110106ca, hbm=0x4a0509ad, start=0x0, cLines=0x1, lpvBits=0x0, lpbmi=0x19e0f4, usage=0x0 | out: lpvBits=0x0, lpbmi=0x19e0f4) returned 1
[0185.075] DeleteObject (ho=0x4a0509ad) returned 1
[0185.075] CreateDIBSection (in: hdc=0x110106ca, lpbmi=0x19e144, usage=0x0, ppvBits=0x19e638, hSection=0x0, offset=0x0 | out: ppvBits=0x19e638) returned 0x3f0506d6
[0185.075] SelectObject (hdc=0x810109d5, h=0x3f0506d6) returned 0x185000f
[0185.075] GdipCreateFromHDC (hdc=0x810109d5, graphics=0x19e61c) returned 0x0
[0185.075] GdipTranslateWorldTransform (graphics=0x5b3f268, dx=0x0, dy=0x0, order=0x0) returned 0x0
[0185.075] GdipSetClipRectI (graphics=0x5b3f268, x=0, y=0, width=100, height=23, combineMode=0x0) returned 0x0
[0185.075] GdipCreateMatrix (matrix=0x19e664) returned 0x0
[0185.075] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b46b80) returned 0x0
[0185.075] GdipIsMatrixIdentity (matrix=0x5b46b80, result=0x19e67c) returned 0x0
[0185.076] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee018
[0185.076] GdipGetMatrixElements (matrix=0x5b46b80, matrixOut=0x6ee018) returned 0x0
[0185.076] LocalFree (hMem=0x6ee018) returned 0x0
[0185.077] GdipDeleteMatrix (matrix=0x5b46b80) returned 0x0
[0185.077] GdipCreateRegion (region=0x19e664) returned 0x0
[0185.077] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0
[0185.077] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e670) returned 0x0
[0185.077] GdipSaveGraphics (graphics=0x5b3f268, state=0x19e69c) returned 0x0
[0185.077] GdipRestoreGraphics (graphics=0x5b3f268, state=0xfdb00dbd) returned 0x0
[0185.077] GdipDeleteRegion (region=0x5b48418) returned 0x0
[0185.079] SystemParametersInfoW (in: uiAction=0x42, uiParam=0xc, pvParam=0x19e514, fWinIni=0x0 | out: pvParam=0x19e514) returned 1
[0185.079] GdipGetDC (graphics=0x5b3f268, hdc=0x19e47c) returned 0x0
[0185.080] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017
[0185.080] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010
[0185.080] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6
[0185.080] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048
[0185.080] SaveDC (hdc=0x810109d5) returned 1
[0185.080] GetNearestColor (hdc=0x810109d5, color=0xf0f0f0) returned 0xf0f0f0
[0185.080] GetNearestColor (hdc=0x810109d5, color=0xa0a0a0) returned 0xa0a0a0
[0185.080] GetNearestColor (hdc=0x810109d5, color=0x696969) returned 0x696969
[0185.080] GetNearestColor (hdc=0x810109d5, color=0xa0a0a0) returned 0xa0a0a0
[0185.080] GetNearestColor (hdc=0x810109d5, color=0x0) returned 0x0
[0185.080] GetNearestColor (hdc=0x810109d5, color=0xffffff) returned 0xffffff
[0185.080] GetNearestColor (hdc=0x810109d5, color=0xe5e5e5) returned 0xe5e5e5
[0185.080] GetNearestColor (hdc=0x810109d5, color=0xd7d7d7) returned 0xd7d7d7
[0185.080] GetNearestColor (hdc=0x810109d5, color=0x0) returned 0x0
[0185.080] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1
[0185.081] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0
[0185.082] IsAppThemed () returned 0x1
[0185.083] GetThemeAppProperties () returned 0x3
[0185.083] GetThemeAppProperties () returned 0x3
[0185.083] OpenThemeData () returned 0x10003
[0185.085] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x19e4e4, fWinIni=0x0 | out: pvParam=0x19e4e4) returned 1
[0185.085] SendMessageW (hWnd=0xb004c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
[0185.085] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
[0185.085] IsAppThemed () returned 0x1
[0185.085] GetThemeAppProperties () returned 0x3
[0185.085] GetThemeAppProperties () returned 0x3
[0185.086] DrawTextExW (in: hdc=0x640106b0, lpchText="&Continue", cchText=9, lprc=0x19e338, format=0x102415, lpdtp=0x2337d8c | out: lpchText="&Continue", lprc=0x19e338) returned 13
[0185.087] IsAppThemed () returned 0x1
[0185.087] GetThemeAppProperties () returned 0x3
[0185.087] GetThemeAppProperties () returned 0x3
[0185.087] IsAppThemed () returned 0x1
[0185.088] GetThemeAppProperties () returned 0x3
[0185.088] GetThemeAppProperties () returned 0x3
[0185.091] IsAppThemed () returned 0x1
[0185.091] GetThemeAppProperties () returned 0x3
[0185.091] GetThemeAppProperties () returned 0x3
[0185.091] IsAppThemed () returned 0x1
[0185.091] GetThemeAppProperties () returned 0x3
[0185.091] GetThemeAppProperties () returned 0x3
[0185.091] IsThemePartDefined () returned 0x1
[0185.091] IsAppThemed () returned 0x1
[0185.091] GetThemeAppProperties () returned 0x3
[0185.091] GetThemeAppProperties () returned 0x3
[0185.091] IsThemeBackgroundPartiallyTransparent () returned 0x1
[0185.092] IsAppThemed () returned 0x1
[0185.092] GetThemeAppProperties () returned 0x3
[0185.092] GetThemeAppProperties () returned 0x3
[0185.093] IsAppThemed () returned 0x1
[0185.093] GetThemeAppProperties () returned 0x3
[0185.093] GetThemeAppProperties () returned 0x3
[0185.093] IsThemePartDefined () returned 0x1
[0185.093] GdipCreateRegion (region=0x19e380) returned 0x0
[0185.093] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0
[0185.093] GdipCreateMatrix (matrix=0x19e380) returned 0x0
[0185.093] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b40a08) returned 0x0
[0185.093] GdipIsMatrixIdentity (matrix=0x5b40a08, result=0x19e398) returned 0x0
[0185.093] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6edf70
[0185.093] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6edf70) returned 0x0
[0185.093] LocalFree (hMem=0x6edf70) returned 0x0
[0185.094] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee0f8
[0185.094] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6ee0f8) returned 0x0
[0185.094] LocalFree (hMem=0x6ee0f8) returned 0x0
[0185.094] GdipDeleteMatrix (matrix=0x5b40a08) returned 0x0
[0185.094] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e3c0) returned 0x0
[0185.094] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e3b0) returned 0x0
[0185.094] GdipGetRegionHRgn (region=0x5b48418, graphics=0x5b3f268, hRgn=0x19e3b0) returned 0x0
[0185.094] GdipDeleteRegion (region=0x5b48418) returned 0x0
[0185.094] GdipGetDC (graphics=0x5b3f268, hdc=0x19e3c8) returned 0x0
[0185.094] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017
[0185.094] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010
[0185.094] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6
[0185.095] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048
[0185.095] SaveDC (hdc=0x810109d5) returned 1
[0185.095] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2104087b
[0185.095] GetClipRgn (hdc=0x810109d5, hrgn=0x2104087b) returned 0
[0185.095] SelectClipRgn (hdc=0x810109d5, hrgn=0x610406cc) returned 2
[0185.095] DeleteObject (ho=0x2104087b) returned 1
[0185.095] DeleteObject (ho=0x610406cc) returned 1
[0185.095] OffsetViewportOrgEx (in: hdc=0x810109d5, x=0, y=0, lppt=0x2338468 | out: lppt=0x2338468) returned 1
[0185.095] DrawThemeParentBackground () returned 0x0
[0185.096] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19e0c4 | out: lpwndpl=0x19e0c4) returned 1
[0185.096] GetClientRect (in: hWnd=0xb004c, lpRect=0x19e070 | out: lpRect=0x19e070) returned 1
[0185.096] GetWindowTextLengthW (hWnd=0xb004c) returned 24
[0185.096] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0185.096] GetSystemMetrics (nIndex=42) returned 0
[0185.096] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19df14, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0185.096] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19df14) returned 0x18
[0185.096] GetClientRect (in: hWnd=0xb004c, lpRect=0x19df78 | out: lpRect=0x19df78) returned 1
[0185.096] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017
[0185.096] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010
[0185.096] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6
[0185.096] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048
[0185.096] SaveDC (hdc=0x810109d5) returned 2
[0185.096] GetNearestColor (hdc=0x810109d5, color=0xf0f0f0) returned 0xf0f0f0
[0185.096] CreateSolidBrush (color=0xf0f0f0) returned 0x161008ec
[0185.097] FillRect (hDC=0x810109d5, lprc=0x19de18, hbr=0x161008ec) returned 1
[0185.097] DeleteObject (ho=0x161008ec) returned 1
[0185.097] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1
[0185.097] GetWindowTextLengthW (hWnd=0xb004c) returned 24
[0185.097] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0185.097] GetSystemMetrics (nIndex=42) returned 0
[0185.097] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19deb4, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0185.097] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19deb4) returned 0x18
[0185.097] GetClientRect (in: hWnd=0xb004c, lpRect=0x19df18 | out: lpRect=0x19df18) returned 1
[0185.097] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017
[0185.097] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010
[0185.098] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6
[0185.098] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048
[0185.098] SaveDC (hdc=0x810109d5) returned 2
[0185.098] GetNearestColor (hdc=0x810109d5, color=0xf0f0f0) returned 0xf0f0f0
[0185.098] CreateSolidBrush (color=0xf0f0f0) returned 0x171008ec
[0185.098] FillRect (hDC=0x810109d5, lprc=0x19ddb8, hbr=0x171008ec) returned 1
[0185.098] DeleteObject (ho=0x171008ec) returned 1
[0185.098] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1
[0185.098] GetWindowTextLengthW (hWnd=0xb004c) returned 24
[0185.098] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0185.098] GetSystemMetrics (nIndex=42) returned 0
[0185.098] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19deb4, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0185.098] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19deb4) returned 0x18
[0185.098] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1
[0185.099] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0
[0185.099] IsAppThemed () returned 0x1
[0185.099] GetThemeAppProperties () returned 0x3
[0185.099] GetThemeAppProperties () returned 0x3
[0185.099] IsAppThemed () returned 0x1
[0185.099] GetThemeAppProperties () returned 0x3
[0185.099] GetThemeAppProperties () returned 0x3
[0185.099] IsThemePartDefined () returned 0x1
[0185.099] GdipCreateRegion (region=0x19e324) returned 0x0
[0185.099] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0
[0185.099] GdipCreateMatrix (matrix=0x19e324) returned 0x0
[0185.099] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b46b80) returned 0x0
[0185.099] GdipIsMatrixIdentity (matrix=0x5b46b80, result=0x19e33c) returned 0x0
[0185.099] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ede58
[0185.099] GdipGetMatrixElements (matrix=0x5b46b80, matrixOut=0x6ede58) returned 0x0
[0185.100] LocalFree (hMem=0x6ede58) returned 0x0
[0185.100] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ee440
[0185.100] GdipGetMatrixElements (matrix=0x5b46b80, matrixOut=0x6ee440) returned 0x0
[0185.100] LocalFree (hMem=0x6ee440) returned 0x0
[0185.100] GdipDeleteMatrix (matrix=0x5b46b80) returned 0x0
[0185.100] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e364) returned 0x0
[0185.100] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e354) returned 0x0
[0185.101] GdipGetRegionHRgn (region=0x5b48418, graphics=0x5b3f268, hRgn=0x19e354) returned 0x0
[0185.101] GdipDeleteRegion (region=0x5b48418) returned 0x0
[0185.101] GdipGetDC (graphics=0x5b3f268, hdc=0x19e36c) returned 0x0
[0185.101] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017
[0185.101] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010
[0185.101] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6
[0185.101] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048
[0185.101] SaveDC (hdc=0x810109d5) returned 1
[0185.101] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x620406cc
[0185.101] GetClipRgn (hdc=0x810109d5, hrgn=0x620406cc) returned 0
[0185.102] SelectClipRgn (hdc=0x810109d5, hrgn=0x2304087b) returned 2
[0185.102] DeleteObject (ho=0x620406cc) returned 1
[0185.102] DeleteObject (ho=0x2304087b) returned 1
[0185.102] OffsetViewportOrgEx (in: hdc=0x810109d5, x=0, y=0, lppt=0x2338dec | out: lppt=0x2338dec) returned 1
[0185.102] IsAppThemed () returned 0x1
[0185.102] GetThemeAppProperties () returned 0x3
[0185.102] GetThemeAppProperties () returned 0x3
[0185.103] DrawThemeBackground () returned 0x0
[0185.103] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1
[0185.103] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0
[0185.103] GdipCreateRegion (region=0x19e30c) returned 0x0
[0185.104] GdipGetClip (graphics=0x5b3f268, region=0x5b48418) returned 0x0
[0185.104] GdipCreateMatrix (matrix=0x19e30c) returned 0x0
[0185.104] GdipGetWorldTransform (graphics=0x5b3f268, matrix=0x5b40a08) returned 0x0
[0185.104] GdipIsMatrixIdentity (matrix=0x5b40a08, result=0x19e324) returned 0x0
[0185.104] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6edde8
[0185.104] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6edde8) returned 0x0
[0185.106] LocalFree (hMem=0x6edde8) returned 0x0
[0185.106] LocalAlloc (uFlags=0x0, uBytes=0x30) returned 0x6ede90
[0185.106] GdipGetMatrixElements (matrix=0x5b40a08, matrixOut=0x6ede90) returned 0x0
[0185.107] LocalFree (hMem=0x6ede90) returned 0x0
[0185.107] GdipDeleteMatrix (matrix=0x5b40a08) returned 0x0
[0185.107] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e34c) returned 0x0
[0185.107] GdipIsInfiniteRegion (region=0x5b48418, graphics=0x5b3f268, result=0x19e33c) returned 0x0
[0185.107] GdipGetRegionHRgn (region=0x5b48418, graphics=0x5b3f268, hRgn=0x19e33c) returned 0x0
[0185.107] GdipDeleteRegion (region=0x5b48418) returned 0x0
[0185.107] GdipGetDC (graphics=0x5b3f268, hdc=0x19e354) returned 0x0
[0185.107] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017
[0185.108] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010
[0185.108] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6
[0185.108] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048
[0185.108] SaveDC (hdc=0x810109d5) returned 1
[0185.108] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x2404087b
[0185.108] GetClipRgn (hdc=0x810109d5, hrgn=0x2404087b) returned 0
[0185.108] SelectClipRgn (hdc=0x810109d5, hrgn=0x630406cc) returned 2
[0185.108] DeleteObject (ho=0x2404087b) returned 1
[0185.108] DeleteObject (ho=0x630406cc) returned 1
[0185.108] OffsetViewportOrgEx (in: hdc=0x810109d5, x=0, y=0, lppt=0x23390c0 | out: lppt=0x23390c0) returned 1
[0185.108] IsAppThemed () returned 0x1
[0185.108] GetThemeAppProperties () returned 0x3
[0185.108] GetThemeAppProperties () returned 0x3
[0185.109] GetThemeBackgroundContentRect () returned 0x0
[0185.109] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1
[0185.109] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0
[0185.110] IsAppThemed () returned 0x1
[0185.110] GetThemeAppProperties () returned 0x3
[0185.110] GetThemeAppProperties () returned 0x3
[0185.110] GdipGetTextRenderingHint (graphics=0x5b3f268, mode=0x19e484) returned 0x0
[0185.110] GdipGetDC (graphics=0x5b3f268, hdc=0x19e470) returned 0x0
[0185.110] GetCurrentObject (hdc=0x810109d5, type=0x1) returned 0x1b00017
[0185.110] GetCurrentObject (hdc=0x810109d5, type=0x2) returned 0x1900010
[0185.110] GetCurrentObject (hdc=0x810109d5, type=0x7) returned 0x3f0506d6
[0185.110] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048
[0185.111] SaveDC (hdc=0x810109d5) returned 1
[0185.111] GetTextAlign (hdc=0x810109d5) returned 0x0
[0185.111] GetTextColor (hdc=0x810109d5) returned 0x0
[0185.111] GetCurrentObject (hdc=0x810109d5, type=0x6) returned 0x18a0048
[0185.111] GetObjectW (in: h=0x18a0048, c=92, pv=0x19e178 | out: pv=0x19e178) returned 92
[0185.111] SelectObject (hdc=0x810109d5, h=0x7e0a09e9) returned 0x18a0048
[0185.111] GetBkMode (hdc=0x810109d5) returned 2
[0185.111] SetBkMode (hdc=0x810109d5, mode=1) returned 2
[0185.111] DrawTextExW (in: hdc=0x810109d5, lpchText="&Continue", cchText=9, lprc=0x19e24c, format=0x102415, lpdtp=0x2339460 | out: lpchText="&Continue", lprc=0x19e24c) returned 13
[0185.112] DrawTextExW (in: hdc=0x810109d5, lpchText="&Continue", cchText=9, lprc=0x19e404, format=0x102015, lpdtp=0x2339460 | out: lpchText="&Continue", lprc=0x19e404) returned 13
[0185.112] RestoreDC (hdc=0x810109d5, nSavedDC=-1) returned 1
[0185.112] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0
[0185.112] GetFocus () returned 0x5028a
[0185.112] SystemParametersInfoW (in: uiAction=0x100a, uiParam=0x0, pvParam=0x19e53c, fWinIni=0x0 | out: pvParam=0x19e53c) returned 1
[0185.112] SendMessageW (hWnd=0xb004c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
[0185.112] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x127, wParam=0x30001, lParam=0x0) returned 0x0
[0185.112] IsAppThemed () returned 0x1
[0185.113] GetThemeAppProperties () returned 0x3
[0185.113] GetThemeAppProperties () returned 0x3
[0185.113] GdipGetDC (graphics=0x5b3f268, hdc=0x19e65c) returned 0x0
[0185.113] BitBlt (hdc=0x110106ca, x=0, y=0, cx=100, cy=23, hdcSrc=0x810109d5, x1=0, y1=0, rop=0xcc0020) returned 1
[0185.113] GdipReleaseDC (graphics=0x5b3f268, hdc=0x810109d5) returned 0x0
[0185.113] SelectPalette (hdc=0x110106ca, hPal=0x188000b, bForceBkgd=0) returned 0x6e0806d0
[0185.113] SelectObject (hdc=0x810109d5, h=0x185000f) returned 0x3f0506d6
[0185.113] DeleteDC (hdc=0x810109d5) returned 1
[0185.113] GdipDeleteGraphics (graphics=0x5b3f268) returned 0x0
[0185.113] EndPaint (hWnd=0x5028a, lpPaint=0x19e600) returned 1
[0185.114] MapWindowPoints (in: hWndFrom=0x5028a, hWndTo=0x0, lpPoints=0x233955c, cPoints=0x1 | out: lpPoints=0x233955c) returned 30999254
[0185.114] WindowFromPoint (Point=0x2f0) returned 0x5028a
[0185.114] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1
[0185.114] NotifyWinEvent (event=0x800a, hwnd=0x5028a, idObject=-4, idChild=0)
[0185.114] NotifyWinEvent (event=0x800c, hwnd=0x5028a, idObject=-4, idChild=0)
[0185.114] GetCapture () returned 0x5028a
[0185.114] ReleaseCapture () returned 1
[0185.115] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x215, wParam=0x0, lParam=0x0) returned 0x0
[0185.115] PeekMessageW (in: lpMsg=0x19ee84, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ee84) returned 1
[0185.115] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x84, wParam=0x0, lParam=0x1df02f0) returned 0x1
[0185.143] IsWindow (hWnd=0x802a2) returned 1
[0185.144] EnableWindow (hWnd=0x802a2, bEnable=1) returned 1
[0185.144] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xa, wParam=0x1, lParam=0x0) returned 0x0
[0185.144] GetWindowLongW (hWnd=0xb004c, nIndex=-8) returned 0
[0185.144] IsWindow (hWnd=0x0) returned 0
[0185.144] IsWindow (hWnd=0x0) returned 0
[0185.144] IsWindow (hWnd=0x0) returned 0
[0185.144] GetFocus () returned 0x5028a
[0185.145] IsChild (hWndParent=0xb004c, hWnd=0x5028a) returned 1
[0185.145] ShowWindow (hWnd=0xb004c, nCmdShow=0) returned 1
[0185.145] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0
[0185.145] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x46, wParam=0x0, lParam=0x19ee2c) returned 0x0
[0185.148] GetWindowPlacement (in: hWnd=0xb004c, lpwndpl=0x19eb9c | out: lpwndpl=0x19eb9c) returned 1
[0185.148] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x47, wParam=0x0, lParam=0x19ee2c) returned 0x0
[0185.148] GetClientRect (in: hWnd=0xb004c, lpRect=0x19eb4c | out: lpRect=0x19eb4c) returned 1
[0185.148] GetWindowRect (in: hWnd=0xb004c, lpRect=0x19eb4c | out: lpRect=0x19eb4c) returned 1
[0185.149] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0185.150] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0185.150] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0185.167] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1
[0185.168] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0
[0185.171] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0
[0185.171] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0
[0185.173] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x1c, wParam=0x0, lParam=0x1150) returned 0x0
[0185.173] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x7032c, Msg=0x1c, wParam=0x0, lParam=0x1150) returned 0x0
[0185.173] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0x1c, wParam=0x0, lParam=0x1150) returned 0x0
[0185.173] NtdllDefWindowProc_W (hWnd=0x40200, Msg=0x1c, wParam=0x0, lParam=0x1150) returned 0x0
[0185.173] GetFocus () returned 0x0
[0185.173] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0
[0185.173] GetCapture () returned 0x0
[0185.173] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1
[0185.174] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0
[0185.174] GetKeyboardLayout (idThread=0x0) returned 0x4090409
[0185.174] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0
[0185.178] GetWindowLongW (hWnd=0xb004c, nIndex=-20) returned 327945
[0185.178] DestroyWindow (hWnd=0xb004c) returned 1
[0185.178] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0
[0185.227] GetWindowTextLengthW (hWnd=0xb004c) returned 24
[0185.227] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x18
[0185.227] GetSystemMetrics (nIndex=42) returned 0
[0185.227] GetWindowTextW (in: hWnd=0xb004c, lpString=0x19ea5c, nMaxCount=25 | out: lpString="Microsoft .NET Framework") returned 24
[0185.227] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0xd, wParam=0x19, lParam=0x19ea5c) returned 0x18
[0185.227] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0185.230] GetWindowTextLengthW (hWnd=0x3031c) returned 0
[0185.230] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0
[0185.230] GetSystemMetrics (nIndex=42) returned 0
[0185.230] GetWindowTextW (in: hWnd=0x3031c, lpString=0x19ea90, nMaxCount=1 | out: lpString="") returned 0
[0185.230] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0xd, wParam=0x1, lParam=0x19ea90) returned 0x0
[0185.230] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0185.231] GetWindowThreadProcessId (in: hWnd=0x601fe, lpdwProcessId=0x19eb20 | out: lpdwProcessId=0x19eb20) returned 0xbf8
[0185.231] GetWindow (hWnd=0x601fe, uCmd=0x5) returned 0x0
[0185.231] GetWindowLongW (hWnd=0x601fe, nIndex=-20) returned 65792
[0185.231] DestroyWindow (hWnd=0x601fe) returned 1
[0185.231] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0
[0185.231] GetWindowTextLengthW (hWnd=0x601fe) returned 25
[0185.231] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x19
[0185.231] GetSystemMetrics (nIndex=42) returned 0
[0185.231] GetWindowTextW (in: hWnd=0x601fe, lpString=0x19e62c, nMaxCount=26 | out: lpString="WindowsFormsParkingWindow") returned 25
[0185.231] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0xd, wParam=0x1a, lParam=0x19e62c) returned 0x19
[0185.231] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0185.243] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x601fe, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0185.256] GetWindowTextLengthW (hWnd=0x801f0) returned 242
[0185.256] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0xf2
[0185.256] GetSystemMetrics (nIndex=42) returned 0
[0185.256] GetWindowTextW (in: hWnd=0x801f0, lpString=0x19e898, nMaxCount=243 | out: lpString="Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you click Quit, the application will close immediately.\r\n\r\nUnable to connect to the remote server.") returned 242
[0185.256] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0xd, wParam=0xf3, lParam=0x19e898) returned 0xf2
[0185.256] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0185.256] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0185.257] InvalidateRect (hWnd=0x5028a, lpRect=0x0, bErase=0) returned 1
[0185.257] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0185.257] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0
[0185.257] SendMessageW (hWnd=0x60248, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0
[0185.257] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xb8, wParam=0x0, lParam=0x0) returned 0x0
[0185.257] SendMessageW (hWnd=0x60248, Msg=0xb0, wParam=0x230b138, lParam=0x19eb4c) returned 0x0
[0185.257] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xb0, wParam=0x230b138, lParam=0x19eb4c) returned 0x0
[0185.258] GetWindowTextLengthW (hWnd=0x60248) returned 4562
[0185.258] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x11d2
[0185.258] GetSystemMetrics (nIndex=42) returned 0
[0185.258] CoTaskMemAlloc (cb=0x23aa) returned 0x70be70
[0185.258] GetWindowTextW (in: hWnd=0x60248, lpString=0x70be70, nMaxCount=4563 | out: lpString="See the end of this message for details on invoking \r\njust-in-time (JIT) debugging instead of this dialog box.\r\n\r\n************** Exception Text **************\r\nSystem.Net.WebException: Unable to connect to the remote server ---> System.Net.Sockets.SocketException: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 192.30.89.67:11344\r\n at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)\r\n at System.Net.ServicePoint.ConnectSocketInternal(Boolean connectFailure, Socket s4, Socket s6, Socket& socket, IPAddress& address, ConnectSocketState state, IAsyncResult asyncResult, Exception& exception)\r\n --- End of inner exception stack trace ---\r\n at System.Net.WebClient.UploadValues(Uri address, String method, NameValueCollection data)\r\n at System.Net.WebClient.UploadValues(String address, String method, NameValueCollection data)\r\n at eda2.Form1.GetPublicKey(String url)\r\n at eda2.Form1.StartAction()\r\n at eda2.Form1.Form1_Load(Object sender, EventArgs e)\r\n at System.Windows.Forms.Form.OnLoad(EventArgs e)\r\n at System.Windows.Forms.Form.OnCreateControl()\r\n at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)\r\n at System.Windows.Forms.Control.CreateControl()\r\n at System.Windows.Forms.Control.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Control.WndProc(Message& m)\r\n at System.Windows.Forms.ScrollableControl.WndProc(Message& m)\r\n at System.Windows.Forms.Form.WmShowWindow(Message& m)\r\n at System.Windows.Forms.Form.WndProc(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)\r\n at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)\r\n at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)\r\n\r\n\r\n************** Loaded Assemblies **************\r\nmscorlib\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll\r\n----------------------------------------\r\nnotepad\r\n Assembly Version: 2.1.0.0\r\n Win32 Version: 2.1.0.0\r\n CodeBase: file:///C:/Users/RDHJ0C~1/AppData/Local/Temp/svhost.exe\r\n----------------------------------------\r\nSystem.Windows.Forms\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll\r\n----------------------------------------\r\nSystem\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll\r\n----------------------------------------\r\nSystem.Drawing\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll\r\n----------------------------------------\r\nSystem.Core\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll\r\n----------------------------------------\r\nSystem.Configuration\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll\r\n----------------------------------------\r\nSystem.Xml\r\n Assembly Version: 4.0.0.0\r\n Win32 Version: 4.6.1038.0 built by: NETFXREL2\r\n CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll\r\n----------------------------------------\r\n\r\n************** JIT Debugging **************\r\nTo enable just-in-time (JIT) debugging, the .config file for this\r\napplication or computer (machine.config) must have the\r\njitDebugging value set in the system.windows.forms section.\r\nThe application must also be compiled with debugging\r\nenabled.\r\n\r\nFor example:\r\n\r\n\r\n \r\n\r\n\r\nWhen JIT debugging is enabled, any unhandled exception\r\nwill be sent to the JIT debugger registered on the computer\r\nrather than be handled by this dialog box.\r\n\r\n\r\n") returned 4562
[0185.258] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0xd, wParam=0x11d3, lParam=0x70be70) returned 0x11d2
[0185.258] CoTaskMemFree (pv=0x70be70)
[0185.259] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x1
[0185.260] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x3031c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0185.262] CallWindowProcW (lpPrevWndFunc=0x6f01e980, hWnd=0x801f0, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0185.264] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x701de, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0185.271] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x5028a, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0185.274] CallWindowProcW (lpPrevWndFunc=0x6f07e070, hWnd=0x30328, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0185.276] CallWindowProcW (lpPrevWndFunc=0x6f07c330, hWnd=0x60248, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0185.279] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0xb004c, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0
[0185.292] GetWindowTextLengthW (hWnd=0x802a2) returned 7
[0185.292] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0185.292] GetSystemMetrics (nIndex=42) returned 0
[0185.292] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19f210, nMaxCount=8 | out: lpString="notepad") returned 7
[0185.292] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19f210) returned 0x7
[0185.293] PeekMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f410) returned 1
[0185.293] IsWindowUnicode (hWnd=0x802a2) returned 1
[0185.293] GetMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x19f410) returned 1
[0185.293] TranslateMessage (lpMsg=0x19f410) returned 0
[0185.293] DispatchMessageW (lpMsg=0x19f410) returned 0x0
[0185.293] BeginPaint (in: hWnd=0x802a2, lpPaint=0x19eed4 | out: lpPaint=0x19eed4) returned 0x50107d3
[0185.293] SelectPalette (hdc=0x50107d3, hPal=0x6e0806d0, bForceBkgd=1) returned 0x188000b
[0185.294] GetWindowTextLengthW (hWnd=0x802a2) returned 7
[0185.294] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x7
[0185.294] GetSystemMetrics (nIndex=42) returned 0
[0185.294] GetWindowTextW (in: hWnd=0x802a2, lpString=0x19ee6c, nMaxCount=8 | out: lpString="notepad") returned 7
[0185.294] CallWindowProcW (lpPrevWndFunc=0x777aaee0, hWnd=0x802a2, Msg=0xd, wParam=0x8, lParam=0x19ee6c) returned 0x7
[0185.294] SelectPalette (hdc=0x50107d3, hPal=0x188000b, bForceBkgd=0) returned 0x6e0806d0
[0185.294] EndPaint (hWnd=0x802a2, lpPaint=0x19eed0) returned 1
[0185.294] PeekMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f410) returned 0
[0185.295] PeekMessageW (in: lpMsg=0x19f410, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19f410) returned 0
[0185.295] WaitMessage ()
Thread:
id = 6
os_tid = 0x1c4
Thread:
id = 7
os_tid = 0xd34
Thread:
id = 8
os_tid = 0x590
[0131.640] CoGetContextToken (in: pToken=0x42bfc3c | out: pToken=0x42bfc3c) returned 0x800401f0
[0131.640] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0131.640] RoInitialize () returned 0x1
[0131.640] RoUninitialize () returned 0x0
Thread:
id = 9
os_tid = 0xa08
Thread:
id = 13
os_tid = 0xde0
Thread:
id = 14
os_tid = 0x1390
Thread:
id = 15
os_tid = 0xcc4
Thread:
id = 16
os_tid = 0x3a0
Thread:
id = 17
os_tid = 0x2e8
[0160.363] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0160.363] RoInitialize () returned 0x1
[0160.363] RoUninitialize () returned 0x0
[0160.366] ResetEvent (hEvent=0x36c) returned 1
[0290.365] CoUninitialize ()